Continuity of Operations: Selected Agencies Tested Various
Capabilities during 2006 Governmentwide Exercise (19-NOV-07,
GAO-08-185).
To ensure the availability of essential government services in
emergencies, federal agencies are required to develop continuity
of operations (COOP) plans. The Federal Emergency Management
Agency (FEMA), under the Department of Homeland Security (DHS),
is responsible for disseminating guidance to federal agencies on
developing plans, as well as conducting government-wide exercises
every other year to assess federal continuity readiness. In June
2006, FEMA conducted an exercise called Forward Challenge 06, to
allow agencies to activate COOP plans, deploy essential personnel
to alternate facilities, and perform essential functions. GAO was
asked to describe the extent to which agencies tested continuity
plans and procedures, personnel, and resources during the June
2006 exercise. To do this, GAO selected the eight civilian
agencies with significant responsibilities during national
disasters, analyzed agency exercise documentation, and
interviewed officials to determine which test and exercise
activities each agency included in its participation.
-------------------------Indexing Terms-------------------------
REPORTNUM: GAO-08-185
ACCNO: A78248
TITLE: Continuity of Operations: Selected Agencies Tested
Various Capabilities during 2006 Governmentwide Exercise
DATE: 11/19/2007
SUBJECT: Continuity of government
Continuity of operations
Continuity of operations plan
Emergency management
Emergency preparedness
Emergency preparedness programs
Emergency response plans
Evaluation criteria
Federal agencies
Program evaluation
Reporting requirements
Policies and procedures
Forward Challenge 06
******************************************************************
** This file contains an ASCII representation of the text of a **
** GAO Product. **
** **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced. Tables are included, but **
** may not resemble those in the printed version. **
** **
** Please see the PDF (Portable Document Format) file, when **
** available, for a complete electronic file of the printed **
** document's contents. **
** **
******************************************************************
GAO-08-185
* [1]Report to the Ranking Member, Committee on Oversight and Government
Reform, House of Representatives
* [2]November 2007
* [3]CONTINUITY OF OPERATIONS
* [4]Selected Agencies Tested Various Capabilities during 2006
Governmentwide Exercise
* [5]Contents
* [6]Recommendation for Executive Action
* [7]Agency Comments and Our Evaluation
* [8]October 4, 2007, Briefing to Staff of the Ranking Member, House
Committee on Oversight and Government Reform
* [9]Comments from the Department of Homeland Security
Report to the Ranking Member, Committee on Oversight and Government
Reform, House of Representatives
November 2007
CONTINUITY OF OPERATIONS
Selected Agencies Tested Various Capabilities during 2006 Governmentwide
Exercise
Contents
Abbreviations
COOP continuity of operations
DHS Department of Homeland Security
FEMA Federal Emergency Management Agency
November 19, 2007
The Honorable Tom Davis
Ranking Member
Committee on Oversight and Government Reform
House of Representatives
Dear Mr. Davis,
As you know, essential government services can be interrupted by a range
of events, including terrorist attacks, severe weather, or building-level
emergencies. To ensure that these services are available in emergencies,
federal agencies are required to develop continuity of operations (COOP)
plans. The Federal Emergency Management Agency (FEMA), under the
Department of Homeland Security (DHS), is responsible for disseminating
guidance to federal agencies on developing COOP plans as well as
conducting governmentwide exercises every other year as an assessment of
federal continuity readiness. In June 2006, FEMA conducted an exercise,
called Forward Challenge 06, designed to allow agencies to activate their
plans, deploy essential personnel to alternate facilities, and perform
essential functions.
We previously reported on COOP test, training, and exercise requirements
at your request,^1 and determined that agency plans did not generally
comply with FEMA's guidance. We reported that although a governmentwide
continuity exercise hosted by FEMA in May 2004 helped agencies comply with
test, training, and exercise requirements, few agencies had documented
that they conducted internal tests, training, and exercises at the
recommended frequency.
You requested that we evaluate agency participation in Forward Challenge
06. Specifically, we agreed to describe the extent to which selected
agencies tested their continuity plans and procedures, personnel, and
resources during the governmentwide exercise. For purposes of our review,
we selected eight civilian agencies because of their significant
responsibilities under the National Response Plan, which outlines the
roles of federal agencies in response to national disasters. Specifically,
these eight agencies were designated as coordinators of emergency support
functions and as such, have responsibilities for coordinating federal
interagency support to states and other federal agencies during
emergencies of national significance. For example, DHS is responsible for
coordinating urban search and rescue efforts.^2
To address our objective, we obtained and reviewed documentation regarding
test and exercise activities during Forward Challenge 06 from the selected
agencies. We analyzed the documentation and interviewed agency officials
to determine which of the test and exercise activities each agency
included in its participation in Forward Challenge 06.
We conducted our review from May 2006 through September 2007 in accordance
with generally accepted government auditing standards. The extended period
of time for our analysis was due to a delay in receiving documentation
from DHS. First, 2 days before the exercise, we were informed by DHS that
we would not be able to observe agencies' participation, despite a
previous agreement to do so. Subsequently, we requested documentation on
agencies' participation. As we testified in April 2007, this documentation
was not provided until March of this year.^3 Based on our review of the
documentation, we were able to address the objective.
On October 4, 2007, we provided your office with a briefing on the results
of this review. This report provides the briefing slides to you and
officially transmits our recommendation to the Secretary of Homeland
Security. The slides from the briefing are included as appendix I.
In summary, we determined that during Forward Challenge 06, the eight
agencies performed various test and exercise activities related to COOP
plans and procedures, personnel, and resources. In many cases, agencies
provided documentation to substantiate the specific test and exercise
activities performed. However, in other cases, agencies reported
conducting such activities but did not provide supporting documentation.
Finally, agencies also reported not testing or exercising certain
capabilities during the exercise. In these cases, participating agencies
may have addressed these capabilities in other tests and exercises
conducted during the year, which were outside the scope of our review.
Agencies' inability to substantiate many of the test and exercise
activities that they reported performing during Forward Challenge 06 was
due in part to the absence of specific guidance on what should be
documented in such exercises. While FEMA directed participating agencies
to document issues and requirements for corrective action, significant
findings, and important observations during the Forward Challenge 06
exercise, it did not require participating agencies to document the
specific activities from their test and exercise programs that they
conducted during the exercise. Without adequate records of what has been
tested during a major governmentwide exercise, agencies lack assurance
that they have adequately tested their continuity capabilities at the
frequency outlined in FEMA guidance, which may limit their ability to
fully evaluate their readiness to respond to a disruption. In addition,
adequate records can reduce the potential negative impact of turnover in
key personnel due to attrition or change in administration, and strengthen
agency internal control capabilities.
Recommendation for Executive Action
To better assist agencies in assessing their readiness to respond to
disruptions, we recommend that the Secretary of Homeland Security direct
the FEMA Director to require agencies participating in future
governmentwide exercises to document the specific test and exercise
activities conducted.
Agency Comments and Our Evaluation
We received written comments on a draft of our report from the Director of
the Department of Homeland Security's GAO/OIG Liaison office. (These
comments are reproduced in app. II) In commenting on the report, the
Director stated that the department agreed with our recommendation. In
addition, the Director stated that the department had already complied
with the recommendation during Forward Challenge 06, citing the general
guidance provided in Federal Preparedness Circular 65^4 as well as
evaluations compiled by internal and external evaluators during the
exercise. The Director stated further that the level of documentation was
higher than we reported as demonstrated by external evaluations that he
said did not meet GAO audit standards.
We disagree that FEMA provided adequate guidance on documentation and that
the level of documentation was higher than we reported. While the guidance
provided general direction to agencies to document their test, training,
and exercise programs, it did not specify that agencies were to document
the extent to which each essential function and supporting capability was
tested during this exercise. In addition, we considered the results of the
exercise evaluations in our analysis; but in many cases, these evaluations
did not specify which essential functions and supporting capabilities were
tested during the exercise. The value of such documentation is not to meet
GAO audit standards, as the Director asserts. Instead, as noted in our
briefing, agencies need to fully document their exercise activities to
ensure that they are following FEMA guidance, to mitigate the effects of
potential staff turnover, and to ensure appropriate internal controls.
Nevertheless, the Director stated that FEMA intends to refine its
assessment program, giving specific attention to improving the level of
evaluation documentation. The Director also included technical comments
that we have addressed, as appropriate.
As agreed with your staff, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
after its date. At that time, we will send copies of this report to the
Secretary of Homeland Security, and other interested parties. This report
will also be available at no charge on the GAO Web site at
[10]http://www.gao.gov.
If you or your staff have any questions about this report, please contact
me at (202) 512-6240 or [11]k [email protected]. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on the
last page
of this report. Key contributions to this report were made by James R.
Sweetman, Jr., Assistant Director; Lorne Cammack; Alma Cole; Barbara
Collier; Matthew Grote; Sairah Ijaz; Nick Marinos; Morgan Walts; and Kim
Zelonis.
Sincerely yours,
Linda D. Koontz
Director, Information Management Issues
Appendix I: October 4, 2007, Briefing to Staff of the Ranking Member,
House Committee on Oversight and Government Reform
Appendix II: Comments from the Department of Homeland Security
Footnotes:
[1] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of
Operations: Selected Agencies Could Improve Planning for Use of
Alternate Facilities and Telework during Disruptions, GAO-06-713
(Washington, D.C.: May 11, 2006).
[2] DHS, National Response Plan (Washington, D.C.: December 2004).
[3] GAO, Department of Homeland Security: Observations on GAO Access to
Information on Programs and Activities, GAO-07-700T (Washington, D.C.:
Apr. 25, 2007).
[4] Federal Preparedness Circular 65 is guidance to the federal
executive branch for use in developing viable and executable
contingency plans that facilitate the performance of essential
functions during any emergency.
[5] The FEMA Operations Center is responsible for, among other things,
facilitating information sharing between FEMA and non-FEMA
entities, and providing a status of on-going incidents, responses or
potential events, during an emergency.
[6] An alternate facility provides a physical location from which to
conduct essential functions if the agency�s usual facilities are
unavailable.
[7] DHS, National Response Plan (Washington, D.C.: December 2004).
[8] GAO, Department of Homeland Security: Observations on GAO Access to
Information on Programs and Activities, GAO-07-700T (Washington, D.C.:
Apr. 25, 2007).
[9] Participating agencies may have addressed these capabilities in
other tests and exercises conducted during the year, which were outside
the scope of our review.
[10] FPC 65 states that agency personnel must have access to and be
able to use electronic and hard-copy records and information systems
needed to perform their essential functions.
[11] GAO, Continuity of Operations: Agency Plans Have Improved, but
Better Oversight Could Assist Agencies in Preparing for Emergencies,
GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of
Operations: Selected Agencies Could Improve Planning for Use of
Alternate Facilities and Telework during Disruptions, GAO-06-713
(Washington, D.C.: May 11, 2006).
[End of section]
To view the full product, including the scope
and methodology, click on [12]GAO-08-185 .
For more information, contact Linda Koontz at (202) 512-6240 or
[email protected].
Highlights of [13]GAO-08-185 , a report to the Ranking Member, Committee
on Oversight and Government Reform, House of Representatives
November 2007
CONTINUITY OF OPERATIONS
Selected Agencies Tested Various Capabilities during 2006 Governmentwide
Exercise
To ensure the availability of essential government services in
emergencies, federal agencies are required to develop continuity of
operations (COOP) plans. The Federal Emergency Management Agency (FEMA),
under the Department of Homeland Security (DHS), is responsible for
disseminating guidance to federal agencies on developing plans, as well as
conducting government-wide exercises every other year to assess federal
continuity readiness. In June 2006, FEMA conducted an exercise called
Forward Challenge 06, to allow agencies to activate COOP plans, deploy
essential personnel to alternate facilities, and perform essential
functions.
GAO was asked to describe the extent to which agencies tested continuity
plans and procedures, personnel, and resources during the June 2006
exercise. To do this, GAO selected the eight civilian agencies with
significant responsibilities during national disasters, analyzed agency
exercise documentation, and interviewed officials to determine which test
and exercise activities each agency included in its participation.
[14]What GAO Recommends
GAO recommends that FEMA require agencies participating in future
governmentwide exercises to document the specific test and exercise
activities conducted. In commenting on a draft of this report, DHS agreed
with GAO's recommendation and stated that it intends to refine its
assessment program and improve the level of evaluation documentation.
During Forward Challenge 06, the eight agencies GAO reviewed performed
various test and exercise activities related to COOP plans and procedures,
personnel, and resources. In many cases, agencies provided documentation
to substantiate the specific test and exercise activities performed.
However, in other cases, agencies reported conducting such activities but
did not provide supporting documentation. Finally, agencies also reported
not testing or exercising certain capabilities during the exercise. In
these cases, participating agencies may have addressed these capabilities
in other tests and exercises conducted during the year, which were outside
the scope of GAO's review. The table below presents a summary of the
extent to which agencies conducted various test and exercise activities
during the governmentwide exercise.
Agencies' inability to substantiate many of the test and exercise
activities that they reported performing during Forward Challenge 06 was
due in part to the absence of specific guidance on what should be
documented in such exercises. While FEMA directed participating agencies
to document issues and requirements for corrective action, significant
findings, and important observations during the Forward Challenge 06
exercise, it did not require participating agencies to document the
specific activities from their test and exercise programs that they
conducted during the exercise. Without adequate records of what has been
tested during a major governmentwide exercise, agencies lack assurance
that they have adequately tested their continuity capabilities at the
frequency outlined in FEMA guidance, which may limit their ability to
fully evaluate their readiness to respond to a disruption. In addition,
adequate records can reduce the potential negative impact of turnover in
key personnel due to attrition or change in administration, and strengthen
agency internal control capabilities.
Agency Testing and Exercising of COOP Plans and Procedures, Personnel, and
Resources
Tested but Not tested
Test and exercise Tested and not during
Category activities documented documented exercise^a
Plans and Essential Functions 4 4 0
Procedures Activation and
Notification:
Activation 4 3 1
Notification--COOP 3 4 1
Personnel
Notification--Non-COOP 1 5 2
Personnel
Notification--Alternate 2 2 4
Facility
Notification--FEMA 6 1 1
Operations Center
Debriefing 8 0 0
Personnel COOP Personnel 5 3 0
Participation
Resources Interoperable
Communications:
Communications 8 0 0
Capabilities
Communication with 6 2 0
Internal Contacts
Communication with 4 4 0
External Contacts
Vital Records 6 2 0
Backup Power 1 1 6
Source: GAO.
^aParticipating agencies may have addressed these capabilities in other
tests and exercises conducted during the year, which were outside the
scope of GAO's review.
References
Visible links
10. http://www.gao.gov.
11. mailto:[email protected]
12. http://www.gao.gov/cgi-bin/getrpt?GAO-08-185
13. http://www.gao.gov/cgi-bin/getrpt?GAO-08-185
*** End of document. ***