Continuity of Operations: Selected Agencies Could Improve	 
Planning for Use of Alternate Facilities and Telework during	 
Disruptions (11-MAY-06, GAO-06-713).				 
                                                                 
To ensure that essential government services are available in	 
emergencies, federal agencies are required to develop continuity 
of operations (COOP) plans. The Federal Emergency Management	 
Agency (FEMA), within the Department of Homeland Security (DHS), 
is responsible for overseeing and assessing the status of COOP	 
capabilities of federal executive branch agencies. It has	 
developed guidance stating that agency COOP plans must designate 
alternate facilities and prepare personnel for unannounced	 
relocation to these facilities. The guidance also states that	 
agencies should consider the use of telework in their continuity 
plans. GAO was asked to follow up on its previous work on COOP	 
planning and determine, among other things, to what extent (1) 6 
selected agencies prepared their alternate facilities and (2) 23 
major agencies made preparations necessary to effectively use	 
telework in emergency situations.				 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-06-713 					        
    ACCNO:   A53739						        
  TITLE:     Continuity of Operations: Selected Agencies Could Improve
Planning for Use of Alternate Facilities and Telework during	 
Disruptions							 
     DATE:   05/11/2006 
  SUBJECT:   Continuity of operations				 
	     Continuity of operations plan			 
	     Emergency preparedness				 
	     Emergency response 				 
	     Federal agencies					 
	     Policy evaluation					 
	     Remote access					 
	     Staff utilization					 
	     Strategic planning 				 
	     Telecommuting					 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-06-713

     

     * Recommendations for Executive Action
     * Agency Comments and Our Evaluation
     * GAO's Mission
     * Obtaining Copies of GAO Reports and Testimony
          * Order by Mail or Phone
     * To Report Fraud, Waste, and Abuse in Federal Programs
     * Congressional Relations
     * Public Affairs

Report to the Chairman, Committee on Government Reform, House of
Representatives

United States Government Accountability Office

GAO

May 2006

CONTINUITY OF OPERATIONS

Selected Agencies Could Improve Planning for Use of Alternate Facilities
and Telework during Disruptions

GAO-06-713

Contents

Letter 1

Recommendations for Executive Action 5
Agency Comments and Our Evaluation 5
Appendix I Unclassified Version of April 13, 2006, Briefing to Staff of
the House Committee on Government Reform 8
Appendix II Comments from the Department of Homeland Security 64
Abbreviations

COOP continuity of operations DHS Department of Homeland Security FEMA
Federal Emergency Management Agency FPC Federal Preparedness Circular OPM
Office of Personnel Management PDD Presidential Decision Directive

This is a work of the U.S. government and is not subject to copyright
protection in the United States. It may be reproduced and distributed in
its entirety without further permission from GAO. However, because this
work may contain copyrighted images or other material, permission from the
copyright holder may be necessary if you wish to reproduce this material
separately.

United States Government Accountability Office

Washington, DC 20548

May 11, 2006

The Honorable Tom Davis Chairman Committee on Government Reform House of
Representatives

Dear Mr. Chairman:

As you know, essential government services can be interrupted by a range
of events, including terrorist attacks, severe weather, or building-level
emergencies. Federal agencies are required by Presidential Decision
Directive (PDD) 67 to develop plans for ensuring the continuity of such
services in emergency situations. This directive also designated the
Federal Emergency Management Agency (FEMA) as lead agent for executive
branch continuity of operations (COOP) planning, which includes the
responsibility for formulating guidance on such planning and for assessing
the status of executive branch COOP capabilities. 1

In response, FEMA issued COOP guidance to agencies in July 1999: Federal
Preparedness Circular (FPC) 65. The circular states that, in order to have
a viable COOP capability, agencies should identify their essential
functions, which then provide the basis for subsequent planning steps. The
circular further states that agencies must designate alternate facilities
as part of their continuity plans and prepare their personnel for the
possibility of unannounced relocation of essential functions to these
facilities.

In June 2004, FEMA released an updated version of FPC 65, providing
additional guidance to agencies on each of the topics covered in the
original guidance, including an annex on alternate facilities. According
to the guidance, an agency must identify an alternate facility that
provides sufficient space for relocated personnel to perform essential
agency functions during a COOP event. The guidance also directs agencies
to identify the levels of staff and resources required at the alternate
facility to support the performance of these functions. The identification
of staff and resources-including equipment, critical information systems
and data, and vital records-establishes the preparation requirements for
an alternate facility. For example, in order for an agency to determine
that it has an adequate number of computers present at the alternate
facility, it must first establish how many are required to support
personnel in the performance of essential functions. Once critical
resources are identified, pre-positioning them is necessary to preparing
an alternate facility.

1Although the 2004 version of FPC 65 refers to FEMA as the "lead agent"
for federal executive branch continuity efforts, the 1999 version used the
term "executive agent."

The 2004 version of FPC 65 also states that agencies should consider
telework (also known as work-at-home or flexiplace) as an option in their
COOP planning. Although FPC 65 does not require agency plans to
incorporate telework, using this option can allow employees to contribute
to the performance of agency essential functions without having to
physically relocate to an alternate operating facility. As we reported in
April 2004, telework is an important and viable option for federal
agencies in continuity planning and implementation efforts, especially as
the duration of an emergency event is extended.2 We recommended in that
report that the Secretary of Homeland Security direct the Under Secretary
for Emergency Preparedness and Response to complete efforts to revise
federal COOP guidance to more fully address human capital considerations
by incorporating six organizational actions, the scope of which included
telework.

In 2002 and 2004, we reviewed the extent to which agency COOP plans
complied with FEMA's continuity guidance at the request of the Chairman,
House Committee on Government Reform. In both reviews, we reported that
agency plans did not generally comply with FEMA's guidance. In 2004, we
also surveyed agencies to determine how they planned to use telework
during COOP events and reported that, although agencies were not required
to address telework in their continuity plans, 2 of the 22 responding
agencies did so in the plans that were in place on May 1, 2004.3

For the current review, as agreed with the committee, our objectives were
to determine to what extent agencies have

2GAO, Human Capital: Opportunities to Improve Federal Continuity Planning
Guidance, GAO-04-384 (Washington, D.C.: Apr. 20, 2004).

3GAO, Continuity of Operations: Agency Plans Have Improved, but Better
Oversight Could Assist Agencies in Preparing for Emergencies, GAO-05-577
(Washington, D.C.: Apr. 28, 2005); and Continuity of Operations: Agency
Plans Have Improved, but Better Oversight Could Assist Agencies in
Preparing for Emergencies, GAO-05-619T (Washington, D.C.: Apr. 28, 2005).

           o  prepared alternate facilities where they can perform their
           essential functions in emergencies and
           o  made preparations necessary to effectively use telework in
           emergency situations.

           To achieve our first objective, we obtained and reviewed
           headquarters contingency plans from 23 of the largest civilian
           departments and agencies to identify the population of alternate
           facilities; verified alternate facilities information with each
           agency; and selected, from the population of alternate facilities,
           six alternate facilities illustrating variations in several
           attributes, including agency budget size, distance from respective
           primary work facility, and facility type. For the selected
           alternate facilities, we evaluated compliance with FPC 65 criteria
           by analyzing agency COOP plans and other documentation and by
           visiting alternate facilities. Finally, we obtained and analyzed
           FEMA's COOP guidance and documents describing its efforts to
           provide oversight and assessments of federal planning efforts, and
           conducted interviews with FEMA officials to clarify the activities
           described in these documents.

           For our second objective, we reviewed prior GAO work on telework
           to determine key practices for the development of an effective
           telework program; developed a series of questions regarding agency
           plans and preparations to use telework during a COOP event;
           surveyed agency officials responsible for continuity planning at
           23 of the largest civilian departments and agencies to determine
           to what extent key telework practices were used in making
           continuity preparations; reviewed supporting documentation
           submitted by agency officials to support their responses; and
           created tables that compared this year's survey responses with
           those from our previous survey in 2004.

           We conducted our review between July 2005 and February 2006 in the
           Washington, D.C., area and at several agency alternate facilities
           in accordance with generally accepted government auditing
           standards.

           On April 13, we provided your office with a classified briefing on
           the results of this review. The purpose of this letter is to
           provide you with the unclassified material from our briefing. (See
           app. I.)

           In summary, all six agencies we reviewed had identified alternate
           facilities and took steps to prepare their alternate facilities
           for use in emergencies. For example, most agencies documented
           plans and procedures related to these facilities, including site
           preparation and activation plans. However, none of the agencies
           followed all of FEMA's guidance. For example, none conducted all
           of the applicable tests and exercises outlined in FPC 65,
           including annual exercises that incorporate the deliberate and
           preplanned movement of COOP personnel to the agencies' alternate
           facilities. Further, agencies did not fully identify the levels of
           resources necessary to support their essential functions (e.g.,
           the number of computers to support the performance of essential
           functions), creating a lack of assurance that the agencies'
           facilities are adequately prepared.

           Although each agency is responsible for developing a viable COOP
           plan and ensuring that its alternate facilities are adequately
           prepared, FEMA's limited efforts to oversee and assess agency COOP
           capabilities contributed to the agencies' lack of compliance with
           all of the FPC 65 guidance. For example, FEMA has continued to
           rely on agency-reported information as the basis for its
           assessments. In addition, two planned oversight efforts-a
           readiness reporting system operated by FEMA and a review of agency
           essential functions by the White House-have been delayed.

           According to an official from the Department of Homeland Security
           (DHS)-the parent agency of FEMA-FEMA plans to expand its oversight
           activities to include the evaluation and assessment of individual
           agency COOP capabilities. As part of the methodology for an
           upcoming interagency exercise, known as Forward Challenge 06, FEMA
           officials anticipate using independent observers to evaluate
           agency plans and their implementation during the exercise. In
           addition, officials plan to conduct individual agency COOP
           assessments starting in July 2006. However, details regarding the
           assessment's methodology have yet to be finalized. If FEMA does
           not develop an assessment methodology that evaluates agencies'
           compliance with FPC 65-including the extent to which agencies (1)
           identify essential functions; (2) identify the levels of staff and
           resources required at their alternate facilities; and (3) plan,
           conduct, and document the necessary tests and exercises at the
           appropriate scope and frequency-it will have limited assurance
           that agencies have taken the steps necessary to ensure that they
           will be able to perform essential government operations following
           a disruption.

           Finally, more agencies reported plans for essential team members
           to telework during a COOP event than in our previous survey, but
           few documented that they made the necessary preparations to
           effectively use telework during an emergency. Nine of the 23
           agencies reported that some of their essential team members are
           expected to telework during such an event. However, only 1 agency
           documented that it had communicated this expectation to its
           emergency team members. In addition, only 3 of the 23 agencies
           documented testing the ability of staff to telework during a COOP
           event.

           The lack of specific guidance on the steps that agencies should
           take to ensure that they are fully prepared to use telework during
           a COOP event contributed to the low levels of preparation that
           agencies reported. FEMA recently disseminated guidance to agencies
           regarding the incorporation of pandemic influenza considerations
           into COOP planning. However, while the guidance does suggest the
           use of telework during such an event, it does not address the
           steps agencies should take when preparing to use telework during a
           COOP event. If agencies do not make adequate preparations, they
           may not be able to use telework effectively to ensure the
           continuity of their essential functions in emergencies.

           To ensure that agencies are adequately prepared to continue
           performing essential functions following an emergency, we
           recommend that the Secretary of Homeland Security direct the FEMA
           Director to improve the oversight of agency COOP planning by
           taking the following three actions:

           o  Before the upcoming interagency exercise, conduct an assessment
           of the COOP plans of the six agencies whose alternate facilities
           were included in our review and report any deficiencies to the
           head of the agency for correction.
           o  Develop a methodology for individual agency COOP assessments
           that independently evaluates executive branch agencies' compliance
           with FPC 65, including the extent to which agencies (1) identify
           essential functions; (2) identify the levels of staff and
           resources required at their alternate facilities; and (3) plan,
           conduct, and document the necessary tests and exercises at the
           appropriate scope and frequency. The methodology should include a
           mechanism for reporting any deficiencies to the head of the agency
           for correction.
           o  Establish a time line for developing, in consultation with the
           Office of Personnel Management (OPM), guidance on the steps that
           agencies should take to adequately prepare for the use of telework
           during a COOP event.

           We received written comments on a draft of our report from the
           Director of the Department of Homeland Security's GAO/OIG Liaison
           Office. (These comments are reproduced in app. II.) In commenting
           on the report, the Director stated that DHS partially agreed with
           our recommendations.

           In commenting on oversight of COOP planning, the Director wrote
           that PDD 67 directed that an interagency advisory group shall
           provide coordination, oversight, and management for COOP-related
           activities of executive branch agencies. He added that although
           FEMA is designated as chair of this group, participating agency
           coordinators are designated with the authority to represent and
           commit their agencies in COOP-related matters. However, as we
           point out in our report, according to FPC 65, the presidential
           directive also established FEMA as the lead agency for executive
           branch continuity planning. Included in this responsibility is the
           specific requirement for FEMA to oversee and assess the status of
           COOP capabilities of executive branch agencies.

           In responding to our first recommendation, the Director stated
           that DHS partially agreed and that FEMA will be conducting
           assessments of the six agencies in conjunction with its upcoming
           interagency exercise.

           Regarding our recommendation on developing an assessment
           methodology, the Director wrote that FEMA currently has an
           assessment program and a methodology that includes (1) a
           self-assessment tool to assist senior leaders in performing
           internal assessments, (2) the governmentwide exercise planned for
           June 2006, and (3) a plan for an expanded comprehensive department
           and agency assessment program. He added that FEMA plans to
           continually refine this methodology and expand the program through
           additional funding and resources. In addition, the Director stated
           that the agency's efforts are constrained by resources. He stated
           that to improve the readiness of the federal government's COOP
           program, additional resources are required to support the large
           number of federal offices and facilities that could benefit from
           recurring COOP assessments.

           However, while these steps outline an overall approach to
           assessing agency plans, they do not constitute a methodology for
           assessing agency compliance with FPC 65-including the extent to
           which agencies (1) identify essential functions; (2) identify
           levels of staff and resources required at their alternate
           facilities; and (3) plan, conduct, and document the necessary
           tests and exercise at the appropriate scope and frequency, as we
           have recommended. Without such a methodology, the agency will have
           limited assurance that agencies have taken the necessary steps to
           prepare for an emergency. While we did not review the adequacy of
           FEMA's resources for conducting oversight of agency planning, DHS
           should review how FEMA prioritizes its currently available funding
           for COOP activities and to the extent it agrees that additional
           funding is needed, pursue justifying increases.

           In responding to our recommendation on developing guidance on
           agencies' use of telework, the Director partially agreed and
           stated that FEMA will coordinate with OPM in the development of a
           timeline for further telework guidance. In addition, he stated
           that both FEMA and OPM have provided guidance on the use of
           telework. However, as stated in our report, present guidance does
           not address the preparations agencies should make for using
           telework during emergencies and it is unclear whether and when
           FEMA will release such guidance.

           The Director also included technical comments that we have
           addressed, as appropriate.

           We are sending copies of this report to the appropriate
           congressional committees, the Secretary of Homeland Security, and
           the Director of the Office of Personnel Management, and will make
           copies available to others on request. In addition, the report
           will be available at no charge on the GAO Web site at
           http://www.gao.gov .

           If you or your staff have any questions about this report, please
           contact me at (202) 512-6240 or [email protected] . Key
           contributions to this report were made by James R. Sweetman Jr.,
           Assistant Director; Barbara Collier; Nick Marinos; and Kim
           Zelonis.

           Sincerely yours,

           Linda D. Koontz Director, Information Management Issues

           The Government Accountability Office, the audit, evaluation and
           investigative arm of Congress, exists to support Congress in
           meeting its constitutional responsibilities and to help improve
           the performance and accountability of the federal government for
           the American people. GAO examines the use of public funds;
           evaluates federal programs and policies; and provides analyses,
           recommendations, and other assistance to help Congress make
           informed oversight, policy, and funding decisions. GAO's
           commitment to good government is reflected in its core values of
           accountability, integrity, and reliability.

           The fastest and easiest way to obtain copies of GAO documents at
           no cost is through GAO's Web site ( www.gao.gov ). Each weekday,
           GAO posts newly released reports, testimony, and correspondence on
           its Web site. To have GAO e-mail you a list of newly posted
           products every afternoon, go to www.gao.gov and select "Subscribe
           to Updates."

           The first copy of each printed report is free. Additional copies
           are $2 each. A check or money order should be made out to the
           Superintendent of Documents. GAO also accepts VISA and Mastercard.
           Orders for 100 or more copies mailed to a single address are
           discounted 25 percent. Orders should be sent to:

           U.S. Government Accountability Office 441 G Street NW, Room LM
           Washington, D.C. 20548

           To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax:
           (202) 512-6061

           Contact:

           Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail:
           [email protected] Automated answering system: (800) 424-5454 or
           (202) 512-7470

           Gloria Jarmon, Managing Director, [email protected] (202) 512-4400
           U.S. Government Accountability Office, 441 G Street NW, Room 7125
           Washington, D.C. 20548

           Paul Anderson, Managing Director, [email protected] (202)
           512-4800 U.S. Government Accountability Office, 441 G Street NW,
           Room 7149 Washington, D.C. 20548

                      Recommendations for Executive Action

                       Agency Comments and Our Evaluation

Appendix I: Unclassified Version of April 13, 2006, Briefing to Staff of
the House Committee on Government Reform Appendix I: Unclassified Version
of April 13, 2006, Briefing to Staff of the House Committee on Government
Reform

Appendix II: Comments from the Department of Homeland Security Appendix
II: Comments from the Department of Homeland Security

(310759)

GAO's Mission

Obtaining Copies of GAO Reports and Testimony

Order by Mail or Phone

To Report Fraud, Waste, and Abuse in Federal Programs

Congressional Relations

Public Affairs

www.gao.gov/cgi-bin/getrpt?GAO-06-713.

To view the full product, including the scope

and methodology, click on the link above.

For more information, contact Linda Koontz at (202) 512-6240 or
[email protected].

Highlights of GAO-06-713, a report to the Chairman, Committee on
Government Reform, House of Representatives

May 2006

CONTINUITY OF OPERATIONS

Selected Agencies Could Improve Planning for Use of Alternate Facilities
and Telework during Disruptions

To ensure that essential government services are available in emergencies,
federal agencies are required to develop continuity of operations (COOP)
plans. The Federal Emergency Management Agency (FEMA), within the
Department of Homeland Security (DHS), is responsible for overseeing and
assessing the status of COOP capabilities of federal executive branch
agencies. It has developed guidance stating that agency COOP plans must
designate alternate facilities and prepare personnel for unannounced
relocation to these facilities. The guidance also states that agencies
should consider the use of telework in their continuity plans.

GAO was asked to follow up on its previous work on COOP planning and
determine, among other things, to what extent (1) 6 selected agencies
prepared their alternate facilities and (2) 23 major agencies made
preparations necessary to effectively use telework in emergency
situations.

What GAO Recommends

GAO is making recommendations to DHS aimed at improving the assessment and
oversight of agency continuity planning and developing guidance on
including telework in such planning. In commenting on a draft of this
report, DHS partially agreed with GAO's recommendations and described
actions to implement them.

All six agencies GAO reviewed took steps to prepare their alternate
facilities for use in emergencies. However, none of the agencies followed
all of FEMA's guidance. For example, none conducted all the applicable
tests and exercises, such as annual exercises that involve moving COOP
personnel to alternate facilities. Further, agencies did not fully
identify the resources necessary to support their essential functions,
which reduces assurance that their facilities are adequately prepared.

Although individual agencies are ultimately responsible for preparing
their plans and alternate facilities, FEMA's limited efforts to oversee
and assess agency COOP capabilities contributed to agencies' incomplete
compliance with its guidance. According to an official from the Department
of Homeland Security, FEMA recently developed a schedule of oversight
activities that includes conducting assessments of agency continuity plans
starting in July 2006. However, the assessment's methodology is not yet
finalized. If FEMA does not develop an assessment methodology that
effectively evaluates agencies' compliance, it will have limited assurance
that agencies have taken the steps necessary to ensure that they will be
able to perform essential government operations following a disruption.

Although agencies are not required to use telework in continuity planning,

9 of the 23 agencies surveyed reported plans for essential team members to
telework during a COOP event, compared with 3 in GAO's previous survey.
However, few documented that they made the necessary preparations to
effectively use telework during such an event (see table). For example,
only one agency documented that it had notified its team members of their
expectation to telework during a COOP event. The lack of specific guidance
on preparations for telework during such an event contributed to the low
levels of preparation that agencies reported. If agencies do not make
adequate preparations, they may not be able to use telework effectively to
ensure the continuity of their essential functions in emergencies.

Agency Responses to Selected Questions on Telework in COOP Plans

Source: GAO.

a Agencies responded positively but did not provide adequate documentation
in support.

b In 2004, one agency did not respond, resulting in a total of 22
responses.
*** End of document. ***