Continuity of Operations: Selected Agencies Could Improve
Planning for Use of Alternate Facilities and Telework during
Disruptions (11-MAY-06, GAO-06-713).
To ensure that essential government services are available in
emergencies, federal agencies are required to develop continuity
of operations (COOP) plans. The Federal Emergency Management
Agency (FEMA), within the Department of Homeland Security (DHS),
is responsible for overseeing and assessing the status of COOP
capabilities of federal executive branch agencies. It has
developed guidance stating that agency COOP plans must designate
alternate facilities and prepare personnel for unannounced
relocation to these facilities. The guidance also states that
agencies should consider the use of telework in their continuity
plans. GAO was asked to follow up on its previous work on COOP
planning and determine, among other things, to what extent (1) 6
selected agencies prepared their alternate facilities and (2) 23
major agencies made preparations necessary to effectively use
telework in emergency situations.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-06-713
ACCNO: A53739
TITLE: Continuity of Operations: Selected Agencies Could Improve
Planning for Use of Alternate Facilities and Telework during
Disruptions
DATE: 05/11/2006
SUBJECT: Continuity of operations
Continuity of operations plan
Emergency preparedness
Emergency response
Federal agencies
Policy evaluation
Remote access
Staff utilization
Strategic planning
Telecommuting
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-06-713
* Recommendations for Executive Action
* Agency Comments and Our Evaluation
* GAO's Mission
* Obtaining Copies of GAO Reports and Testimony
* Order by Mail or Phone
* To Report Fraud, Waste, and Abuse in Federal Programs
* Congressional Relations
* Public Affairs
Report to the Chairman, Committee on Government Reform, House of
Representatives
United States Government Accountability Office
GAO
May 2006
CONTINUITY OF OPERATIONS
Selected Agencies Could Improve Planning for Use of Alternate Facilities
and Telework during Disruptions
GAO-06-713
Contents
Letter 1
Recommendations for Executive Action 5
Agency Comments and Our Evaluation 5
Appendix I Unclassified Version of April 13, 2006, Briefing to Staff of
the House Committee on Government Reform 8
Appendix II Comments from the Department of Homeland Security 64
Abbreviations
COOP continuity of operations DHS Department of Homeland Security FEMA
Federal Emergency Management Agency FPC Federal Preparedness Circular OPM
Office of Personnel Management PDD Presidential Decision Directive
This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.
United States Government Accountability Office
Washington, DC 20548
May 11, 2006
The Honorable Tom Davis Chairman Committee on Government Reform House of
Representatives
Dear Mr. Chairman:
As you know, essential government services can be interrupted by a range
of events, including terrorist attacks, severe weather, or building-level
emergencies. Federal agencies are required by Presidential Decision
Directive (PDD) 67 to develop plans for ensuring the continuity of such
services in emergency situations. This directive also designated the
Federal Emergency Management Agency (FEMA) as lead agent for executive
branch continuity of operations (COOP) planning, which includes the
responsibility for formulating guidance on such planning and for assessing
the status of executive branch COOP capabilities. 1
In response, FEMA issued COOP guidance to agencies in July 1999: Federal
Preparedness Circular (FPC) 65. The circular states that, in order to have
a viable COOP capability, agencies should identify their essential
functions, which then provide the basis for subsequent planning steps. The
circular further states that agencies must designate alternate facilities
as part of their continuity plans and prepare their personnel for the
possibility of unannounced relocation of essential functions to these
facilities.
In June 2004, FEMA released an updated version of FPC 65, providing
additional guidance to agencies on each of the topics covered in the
original guidance, including an annex on alternate facilities. According
to the guidance, an agency must identify an alternate facility that
provides sufficient space for relocated personnel to perform essential
agency functions during a COOP event. The guidance also directs agencies
to identify the levels of staff and resources required at the alternate
facility to support the performance of these functions. The identification
of staff and resources-including equipment, critical information systems
and data, and vital records-establishes the preparation requirements for
an alternate facility. For example, in order for an agency to determine
that it has an adequate number of computers present at the alternate
facility, it must first establish how many are required to support
personnel in the performance of essential functions. Once critical
resources are identified, pre-positioning them is necessary to preparing
an alternate facility.
1Although the 2004 version of FPC 65 refers to FEMA as the "lead agent"
for federal executive branch continuity efforts, the 1999 version used the
term "executive agent."
The 2004 version of FPC 65 also states that agencies should consider
telework (also known as work-at-home or flexiplace) as an option in their
COOP planning. Although FPC 65 does not require agency plans to
incorporate telework, using this option can allow employees to contribute
to the performance of agency essential functions without having to
physically relocate to an alternate operating facility. As we reported in
April 2004, telework is an important and viable option for federal
agencies in continuity planning and implementation efforts, especially as
the duration of an emergency event is extended.2 We recommended in that
report that the Secretary of Homeland Security direct the Under Secretary
for Emergency Preparedness and Response to complete efforts to revise
federal COOP guidance to more fully address human capital considerations
by incorporating six organizational actions, the scope of which included
telework.
In 2002 and 2004, we reviewed the extent to which agency COOP plans
complied with FEMA's continuity guidance at the request of the Chairman,
House Committee on Government Reform. In both reviews, we reported that
agency plans did not generally comply with FEMA's guidance. In 2004, we
also surveyed agencies to determine how they planned to use telework
during COOP events and reported that, although agencies were not required
to address telework in their continuity plans, 2 of the 22 responding
agencies did so in the plans that were in place on May 1, 2004.3
For the current review, as agreed with the committee, our objectives were
to determine to what extent agencies have
2GAO, Human Capital: Opportunities to Improve Federal Continuity Planning
Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).
3GAO, Continuity of Operations: Agency Plans Have Improved, but Better
Oversight Could Assist Agencies in Preparing for Emergencies, GAO-05-577
(Washington, D.C.: Apr. 28, 2005); and Continuity of Operations: Agency
Plans Have Improved, but Better Oversight Could Assist Agencies in
Preparing for Emergencies, GAO-05-619T (Washington, D.C.: Apr. 28, 2005).
o prepared alternate facilities where they can perform their
essential functions in emergencies and
o made preparations necessary to effectively use telework in
emergency situations.
To achieve our first objective, we obtained and reviewed
headquarters contingency plans from 23 of the largest civilian
departments and agencies to identify the population of alternate
facilities; verified alternate facilities information with each
agency; and selected, from the population of alternate facilities,
six alternate facilities illustrating variations in several
attributes, including agency budget size, distance from respective
primary work facility, and facility type. For the selected
alternate facilities, we evaluated compliance with FPC 65 criteria
by analyzing agency COOP plans and other documentation and by
visiting alternate facilities. Finally, we obtained and analyzed
FEMA's COOP guidance and documents describing its efforts to
provide oversight and assessments of federal planning efforts, and
conducted interviews with FEMA officials to clarify the activities
described in these documents.
For our second objective, we reviewed prior GAO work on telework
to determine key practices for the development of an effective
telework program; developed a series of questions regarding agency
plans and preparations to use telework during a COOP event;
surveyed agency officials responsible for continuity planning at
23 of the largest civilian departments and agencies to determine
to what extent key telework practices were used in making
continuity preparations; reviewed supporting documentation
submitted by agency officials to support their responses; and
created tables that compared this year's survey responses with
those from our previous survey in 2004.
We conducted our review between July 2005 and February 2006 in the
Washington, D.C., area and at several agency alternate facilities
in accordance with generally accepted government auditing
standards.
On April 13, we provided your office with a classified briefing on
the results of this review. The purpose of this letter is to
provide you with the unclassified material from our briefing. (See
app. I.)
In summary, all six agencies we reviewed had identified alternate
facilities and took steps to prepare their alternate facilities
for use in emergencies. For example, most agencies documented
plans and procedures related to these facilities, including site
preparation and activation plans. However, none of the agencies
followed all of FEMA's guidance. For example, none conducted all
of the applicable tests and exercises outlined in FPC 65,
including annual exercises that incorporate the deliberate and
preplanned movement of COOP personnel to the agencies' alternate
facilities. Further, agencies did not fully identify the levels of
resources necessary to support their essential functions (e.g.,
the number of computers to support the performance of essential
functions), creating a lack of assurance that the agencies'
facilities are adequately prepared.
Although each agency is responsible for developing a viable COOP
plan and ensuring that its alternate facilities are adequately
prepared, FEMA's limited efforts to oversee and assess agency COOP
capabilities contributed to the agencies' lack of compliance with
all of the FPC 65 guidance. For example, FEMA has continued to
rely on agency-reported information as the basis for its
assessments. In addition, two planned oversight efforts-a
readiness reporting system operated by FEMA and a review of agency
essential functions by the White House-have been delayed.
According to an official from the Department of Homeland Security
(DHS)-the parent agency of FEMA-FEMA plans to expand its oversight
activities to include the evaluation and assessment of individual
agency COOP capabilities. As part of the methodology for an
upcoming interagency exercise, known as Forward Challenge 06, FEMA
officials anticipate using independent observers to evaluate
agency plans and their implementation during the exercise. In
addition, officials plan to conduct individual agency COOP
assessments starting in July 2006. However, details regarding the
assessment's methodology have yet to be finalized. If FEMA does
not develop an assessment methodology that evaluates agencies'
compliance with FPC 65-including the extent to which agencies (1)
identify essential functions; (2) identify the levels of staff and
resources required at their alternate facilities; and (3) plan,
conduct, and document the necessary tests and exercises at the
appropriate scope and frequency-it will have limited assurance
that agencies have taken the steps necessary to ensure that they
will be able to perform essential government operations following
a disruption.
Finally, more agencies reported plans for essential team members
to telework during a COOP event than in our previous survey, but
few documented that they made the necessary preparations to
effectively use telework during an emergency. Nine of the 23
agencies reported that some of their essential team members are
expected to telework during such an event. However, only 1 agency
documented that it had communicated this expectation to its
emergency team members. In addition, only 3 of the 23 agencies
documented testing the ability of staff to telework during a COOP
event.
The lack of specific guidance on the steps that agencies should
take to ensure that they are fully prepared to use telework during
a COOP event contributed to the low levels of preparation that
agencies reported. FEMA recently disseminated guidance to agencies
regarding the incorporation of pandemic influenza considerations
into COOP planning. However, while the guidance does suggest the
use of telework during such an event, it does not address the
steps agencies should take when preparing to use telework during a
COOP event. If agencies do not make adequate preparations, they
may not be able to use telework effectively to ensure the
continuity of their essential functions in emergencies.
To ensure that agencies are adequately prepared to continue
performing essential functions following an emergency, we
recommend that the Secretary of Homeland Security direct the FEMA
Director to improve the oversight of agency COOP planning by
taking the following three actions:
o Before the upcoming interagency exercise, conduct an assessment
of the COOP plans of the six agencies whose alternate facilities
were included in our review and report any deficiencies to the
head of the agency for correction.
o Develop a methodology for individual agency COOP assessments
that independently evaluates executive branch agencies' compliance
with FPC 65, including the extent to which agencies (1) identify
essential functions; (2) identify the levels of staff and
resources required at their alternate facilities; and (3) plan,
conduct, and document the necessary tests and exercises at the
appropriate scope and frequency. The methodology should include a
mechanism for reporting any deficiencies to the head of the agency
for correction.
o Establish a time line for developing, in consultation with the
Office of Personnel Management (OPM), guidance on the steps that
agencies should take to adequately prepare for the use of telework
during a COOP event.
We received written comments on a draft of our report from the
Director of the Department of Homeland Security's GAO/OIG Liaison
Office. (These comments are reproduced in app. II.) In commenting
on the report, the Director stated that DHS partially agreed with
our recommendations.
In commenting on oversight of COOP planning, the Director wrote
that PDD 67 directed that an interagency advisory group shall
provide coordination, oversight, and management for COOP-related
activities of executive branch agencies. He added that although
FEMA is designated as chair of this group, participating agency
coordinators are designated with the authority to represent and
commit their agencies in COOP-related matters. However, as we
point out in our report, according to FPC 65, the presidential
directive also established FEMA as the lead agency for executive
branch continuity planning. Included in this responsibility is the
specific requirement for FEMA to oversee and assess the status of
COOP capabilities of executive branch agencies.
In responding to our first recommendation, the Director stated
that DHS partially agreed and that FEMA will be conducting
assessments of the six agencies in conjunction with its upcoming
interagency exercise.
Regarding our recommendation on developing an assessment
methodology, the Director wrote that FEMA currently has an
assessment program and a methodology that includes (1) a
self-assessment tool to assist senior leaders in performing
internal assessments, (2) the governmentwide exercise planned for
June 2006, and (3) a plan for an expanded comprehensive department
and agency assessment program. He added that FEMA plans to
continually refine this methodology and expand the program through
additional funding and resources. In addition, the Director stated
that the agency's efforts are constrained by resources. He stated
that to improve the readiness of the federal government's COOP
program, additional resources are required to support the large
number of federal offices and facilities that could benefit from
recurring COOP assessments.
However, while these steps outline an overall approach to
assessing agency plans, they do not constitute a methodology for
assessing agency compliance with FPC 65-including the extent to
which agencies (1) identify essential functions; (2) identify
levels of staff and resources required at their alternate
facilities; and (3) plan, conduct, and document the necessary
tests and exercise at the appropriate scope and frequency, as we
have recommended. Without such a methodology, the agency will have
limited assurance that agencies have taken the necessary steps to
prepare for an emergency. While we did not review the adequacy of
FEMA's resources for conducting oversight of agency planning, DHS
should review how FEMA prioritizes its currently available funding
for COOP activities and to the extent it agrees that additional
funding is needed, pursue justifying increases.
In responding to our recommendation on developing guidance on
agencies' use of telework, the Director partially agreed and
stated that FEMA will coordinate with OPM in the development of a
timeline for further telework guidance. In addition, he stated
that both FEMA and OPM have provided guidance on the use of
telework. However, as stated in our report, present guidance does
not address the preparations agencies should make for using
telework during emergencies and it is unclear whether and when
FEMA will release such guidance.
The Director also included technical comments that we have
addressed, as appropriate.
We are sending copies of this report to the appropriate
congressional committees, the Secretary of Homeland Security, and
the Director of the Office of Personnel Management, and will make
copies available to others on request. In addition, the report
will be available at no charge on the GAO Web site at
http://www.gao.gov .
If you or your staff have any questions about this report, please
contact me at (202) 512-6240 or [email protected] . Key
contributions to this report were made by James R. Sweetman Jr.,
Assistant Director; Barbara Collier; Nick Marinos; and Kim
Zelonis.
Sincerely yours,
Linda D. Koontz Director, Information Management Issues
The Government Accountability Office, the audit, evaluation and
investigative arm of Congress, exists to support Congress in
meeting its constitutional responsibilities and to help improve
the performance and accountability of the federal government for
the American people. GAO examines the use of public funds;
evaluates federal programs and policies; and provides analyses,
recommendations, and other assistance to help Congress make
informed oversight, policy, and funding decisions. GAO's
commitment to good government is reflected in its core values of
accountability, integrity, and reliability.
The fastest and easiest way to obtain copies of GAO documents at
no cost is through GAO's Web site ( www.gao.gov ). Each weekday,
GAO posts newly released reports, testimony, and correspondence on
its Web site. To have GAO e-mail you a list of newly posted
products every afternoon, go to www.gao.gov and select "Subscribe
to Updates."
The first copy of each printed report is free. Additional copies
are $2 each. A check or money order should be made out to the
Superintendent of Documents. GAO also accepts VISA and Mastercard.
Orders for 100 or more copies mailed to a single address are
discounted 25 percent. Orders should be sent to:
U.S. Government Accountability Office 441 G Street NW, Room LM
Washington, D.C. 20548
To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax:
(202) 512-6061
Contact:
Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
[email protected] Automated answering system: (800) 424-5454 or
(202) 512-7470
Gloria Jarmon, Managing Director, [email protected] (202) 512-4400
U.S. Government Accountability Office, 441 G Street NW, Room 7125
Washington, D.C. 20548
Paul Anderson, Managing Director, [email protected] (202)
512-4800 U.S. Government Accountability Office, 441 G Street NW,
Room 7149 Washington, D.C. 20548
Recommendations for Executive Action
Agency Comments and Our Evaluation
Appendix I: Unclassified Version of April 13, 2006, Briefing to Staff of
the House Committee on Government Reform Appendix I: Unclassified Version
of April 13, 2006, Briefing to Staff of the House Committee on Government
Reform
Appendix II: Comments from the Department of Homeland Security Appendix
II: Comments from the Department of Homeland Security
(310759)
GAO's Mission
Obtaining Copies of GAO Reports and Testimony
Order by Mail or Phone
To Report Fraud, Waste, and Abuse in Federal Programs
Congressional Relations
Public Affairs
www.gao.gov/cgi-bin/getrpt?GAO-06-713.
To view the full product, including the scope
and methodology, click on the link above.
For more information, contact Linda Koontz at (202) 512-6240 or
[email protected].
Highlights of GAO-06-713, a report to the Chairman, Committee on
Government Reform, House of Representatives
May 2006
CONTINUITY OF OPERATIONS
Selected Agencies Could Improve Planning for Use of Alternate Facilities
and Telework during Disruptions
To ensure that essential government services are available in emergencies,
federal agencies are required to develop continuity of operations (COOP)
plans. The Federal Emergency Management Agency (FEMA), within the
Department of Homeland Security (DHS), is responsible for overseeing and
assessing the status of COOP capabilities of federal executive branch
agencies. It has developed guidance stating that agency COOP plans must
designate alternate facilities and prepare personnel for unannounced
relocation to these facilities. The guidance also states that agencies
should consider the use of telework in their continuity plans.
GAO was asked to follow up on its previous work on COOP planning and
determine, among other things, to what extent (1) 6 selected agencies
prepared their alternate facilities and (2) 23 major agencies made
preparations necessary to effectively use telework in emergency
situations.
What GAO Recommends
GAO is making recommendations to DHS aimed at improving the assessment and
oversight of agency continuity planning and developing guidance on
including telework in such planning. In commenting on a draft of this
report, DHS partially agreed with GAO's recommendations and described
actions to implement them.
All six agencies GAO reviewed took steps to prepare their alternate
facilities for use in emergencies. However, none of the agencies followed
all of FEMA's guidance. For example, none conducted all the applicable
tests and exercises, such as annual exercises that involve moving COOP
personnel to alternate facilities. Further, agencies did not fully
identify the resources necessary to support their essential functions,
which reduces assurance that their facilities are adequately prepared.
Although individual agencies are ultimately responsible for preparing
their plans and alternate facilities, FEMA's limited efforts to oversee
and assess agency COOP capabilities contributed to agencies' incomplete
compliance with its guidance. According to an official from the Department
of Homeland Security, FEMA recently developed a schedule of oversight
activities that includes conducting assessments of agency continuity plans
starting in July 2006. However, the assessment's methodology is not yet
finalized. If FEMA does not develop an assessment methodology that
effectively evaluates agencies' compliance, it will have limited assurance
that agencies have taken the steps necessary to ensure that they will be
able to perform essential government operations following a disruption.
Although agencies are not required to use telework in continuity planning,
9 of the 23 agencies surveyed reported plans for essential team members to
telework during a COOP event, compared with 3 in GAO's previous survey.
However, few documented that they made the necessary preparations to
effectively use telework during such an event (see table). For example,
only one agency documented that it had notified its team members of their
expectation to telework during a COOP event. The lack of specific guidance
on preparations for telework during such an event contributed to the low
levels of preparation that agencies reported. If agencies do not make
adequate preparations, they may not be able to use telework effectively to
ensure the continuity of their essential functions in emergencies.
Agency Responses to Selected Questions on Telework in COOP Plans
Source: GAO.
a Agencies responded positively but did not provide adequate documentation
in support.
b In 2004, one agency did not respond, resulting in a total of 22
responses.
*** End of document. ***