Continuity of Operations: Selected Agencies Tested Various	 
Capabilities during 2006 Governmentwide Exercise (19-NOV-07,	 
GAO-08-185).							 
                                                                 
To ensure the availability of essential government services in	 
emergencies, federal agencies are required to develop continuity 
of operations (COOP) plans. The Federal Emergency Management	 
Agency (FEMA), under the Department of Homeland Security (DHS),  
is responsible for disseminating guidance to federal agencies on 
developing plans, as well as conducting government-wide exercises
every other year to assess federal continuity readiness. In June 
2006, FEMA conducted an exercise called Forward Challenge 06, to 
allow agencies to activate COOP plans, deploy essential personnel
to alternate facilities, and perform essential functions. GAO was
asked to describe the extent to which agencies tested continuity 
plans and procedures, personnel, and resources during the June	 
2006 exercise. To do this, GAO selected the eight civilian	 
agencies with significant responsibilities during national	 
disasters, analyzed agency exercise documentation, and		 
interviewed officials to determine which test and exercise	 
activities each agency included in its participation.		 
-------------------------Indexing Terms------------------------- 
REPORTNUM:   GAO-08-185 					        
    ACCNO:   A78248						        
  TITLE:     Continuity of Operations: Selected Agencies Tested       
Various Capabilities during 2006 Governmentwide Exercise	 
     DATE:   11/19/2007 
  SUBJECT:   Continuity of government				 
	     Continuity of operations				 
	     Continuity of operations plan			 
	     Emergency management				 
	     Emergency preparedness				 
	     Emergency preparedness programs			 
	     Emergency response plans				 
	     Evaluation criteria				 
	     Federal agencies					 
	     Program evaluation 				 
	     Reporting requirements				 
	     Policies and procedures				 
	     Forward Challenge 06				 

******************************************************************
** This file contains an ASCII representation of the text of a  **
** GAO Product.                                                 **
**                                                              **
** No attempt has been made to display graphic images, although **
** figure captions are reproduced.  Tables are included, but    **
** may not resemble those in the printed version.               **
**                                                              **
** Please see the PDF (Portable Document Format) file, when     **
** available, for a complete electronic file of the printed     **
** document's contents.                                         **
**                                                              **
******************************************************************
GAO-08-185

   

     * [1]Report to the Ranking Member, Committee on Oversight and Government
       Reform, House of Representatives

          * [2]November 2007

     * [3]CONTINUITY OF OPERATIONS

          * [4]Selected Agencies Tested Various Capabilities during 2006
            Governmentwide Exercise

     * [5]Contents

          * [6]Recommendation for Executive Action
          * [7]Agency Comments and Our Evaluation

     * [8]October 4, 2007, Briefing to Staff of the Ranking Member, House
       Committee on Oversight and Government Reform
     * [9]Comments from the Department of Homeland Security

Report to the Ranking Member, Committee on Oversight and Government
Reform, House of Representatives

November 2007

CONTINUITY OF OPERATIONS

Selected Agencies Tested Various Capabilities during 2006 Governmentwide
Exercise

Contents

Abbreviations

COOP continuity of operations
DHS Department of Homeland Security
FEMA Federal Emergency Management Agency

November 19, 2007

The Honorable Tom Davis
Ranking Member
Committee on Oversight and Government Reform
House of Representatives

Dear Mr. Davis,

As you know, essential government services can be interrupted by a range
of events, including terrorist attacks, severe weather, or building-level
emergencies. To ensure that these services are available in emergencies,
federal agencies are required to develop continuity of operations (COOP)
plans. The Federal Emergency Management Agency (FEMA), under the
Department of Homeland Security (DHS), is responsible for disseminating
guidance to federal agencies on developing COOP plans as well as
conducting governmentwide exercises every other year as an assessment of
federal continuity readiness. In June 2006, FEMA conducted an exercise,
called Forward Challenge 06, designed to allow agencies to activate their
plans, deploy essential personnel to alternate facilities, and perform
essential functions.

We previously reported on COOP test, training, and exercise requirements
at your request,^1 and determined that agency plans did not generally
comply with FEMA's guidance. We reported that although a governmentwide
continuity exercise hosted by FEMA in May 2004 helped agencies comply with
test, training, and exercise requirements, few agencies had documented
that they conducted internal tests, training, and exercises at the
recommended frequency.

You requested that we evaluate agency participation in Forward Challenge
06. Specifically, we agreed to describe the extent to which selected
agencies tested their continuity plans and procedures, personnel, and
resources during the governmentwide exercise. For purposes of our review,
we selected eight civilian agencies because of their significant
responsibilities under the National Response Plan, which outlines the
roles of federal agencies in response to national disasters. Specifically,
these eight agencies were designated as coordinators of emergency support
functions and as such, have responsibilities for coordinating federal
interagency support to states and other federal agencies during
emergencies of national significance. For example, DHS is responsible for
coordinating urban search and rescue efforts.^2

To address our objective, we obtained and reviewed documentation regarding
test and exercise activities during Forward Challenge 06 from the selected
agencies. We analyzed the documentation and interviewed agency officials
to determine which of the test and exercise activities each agency
included in its participation in Forward Challenge 06.

We conducted our review from May 2006 through September 2007 in accordance
with generally accepted government auditing standards. The extended period
of time for our analysis was due to a delay in receiving documentation
from DHS. First, 2 days before the exercise, we were informed by DHS that
we would not be able to observe agencies' participation, despite a
previous agreement to do so. Subsequently, we requested documentation on
agencies' participation. As we testified in April 2007, this documentation
was not provided until March of this year.^3 Based on our review of the
documentation, we were able to address the objective.

On October 4, 2007, we provided your office with a briefing on the results
of this review. This report provides the briefing slides to you and
officially transmits our recommendation to the Secretary of Homeland
Security. The slides from the briefing are included as appendix I.

In summary, we determined that during Forward Challenge 06, the eight
agencies performed various test and exercise activities related to COOP
plans and procedures, personnel, and resources. In many cases, agencies
provided documentation to substantiate the specific test and exercise
activities performed. However, in other cases, agencies reported
conducting such activities but did not provide supporting documentation.
Finally, agencies also reported not testing or exercising certain
capabilities during the exercise. In these cases, participating agencies
may have addressed these capabilities in other tests and exercises
conducted during the year, which were outside the scope of our review.

Agencies' inability to substantiate many of the test and exercise
activities that they reported performing during Forward Challenge 06 was
due in part to the absence of specific guidance on what should be
documented in such exercises. While FEMA directed participating agencies
to document issues and requirements for corrective action, significant
findings, and important observations during the Forward Challenge 06
exercise, it did not require participating agencies to document the
specific activities from their test and exercise programs that they
conducted during the exercise. Without adequate records of what has been
tested during a major governmentwide exercise, agencies lack assurance
that they have adequately tested their continuity capabilities at the
frequency outlined in FEMA guidance, which may limit their ability to
fully evaluate their readiness to respond to a disruption. In addition,
adequate records can reduce the potential negative impact of turnover in
key personnel due to attrition or change in administration, and strengthen
agency internal control capabilities.

Recommendation for Executive Action

To better assist agencies in assessing their readiness to respond to
disruptions, we recommend that the Secretary of Homeland Security direct
the FEMA Director to require agencies participating in future
governmentwide exercises to document the specific test and exercise
activities conducted.

Agency Comments and Our Evaluation

We received written comments on a draft of our report from the Director of
the Department of Homeland Security's GAO/OIG Liaison office. (These
comments are reproduced in app. II) In commenting on the report, the
Director stated that the department agreed with our recommendation. In
addition, the Director stated that the department had already complied
with the recommendation during Forward Challenge 06, citing the general
guidance provided in Federal Preparedness Circular 65^4 as well as
evaluations compiled by internal and external evaluators during the
exercise. The Director stated further that the level of documentation was
higher than we reported as demonstrated by external evaluations that he
said did not meet GAO audit standards.

We disagree that FEMA provided adequate guidance on documentation and that
the level of documentation was higher than we reported. While the guidance
provided general direction to agencies to document their test, training,
and exercise programs, it did not specify that agencies were to document
the extent to which each essential function and supporting capability was
tested during this exercise. In addition, we considered the results of the
exercise evaluations in our analysis; but in many cases, these evaluations
did not specify which essential functions and supporting capabilities were
tested during the exercise. The value of such documentation is not to meet
GAO audit standards, as the Director asserts. Instead, as noted in our
briefing, agencies need to fully document their exercise activities to
ensure that they are following FEMA guidance, to mitigate the effects of
potential staff turnover, and to ensure appropriate internal controls.
Nevertheless, the Director stated that FEMA intends to refine its
assessment program, giving specific attention to improving the level of
evaluation documentation. The Director also included technical comments
that we have addressed, as appropriate.

As agreed with your staff, unless you publicly announce its contents
earlier, we plan no further distribution of this report until 30 days
after its date. At that time, we will send copies of this report to the
Secretary of Homeland Security, and other interested parties. This report
will also be available at no charge on the GAO Web site at
[10]http://www.gao.gov.

If you or your staff have any questions about this report, please contact
me at (202) 512-6240 or [11]k  [email protected]. Contact points for our
Offices of Congressional Relations and Public Affairs may be found on the
last page

of this report. Key contributions to this report were made by James R.
Sweetman, Jr., Assistant Director; Lorne Cammack; Alma Cole; Barbara
Collier; Matthew Grote; Sairah Ijaz; Nick Marinos; Morgan Walts; and Kim
Zelonis.

Sincerely yours,

Linda D. Koontz
Director, Information Management Issues

Appendix I:  October 4, 2007, Briefing to Staff of the Ranking Member,
House Committee on Oversight and Government Reform

Appendix II: Comments from the Department of Homeland Security

Footnotes: 

[1] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of 
Operations: Selected Agencies Could Improve Planning for Use of 
Alternate Facilities and Telework during Disruptions, GAO-06-713 
(Washington, D.C.: May 11, 2006). 

[2] DHS, National Response Plan (Washington, D.C.: December 2004). 

[3] GAO, Department of Homeland Security: Observations on GAO Access to 
Information on Programs and Activities, GAO-07-700T (Washington, D.C.: 
Apr. 25, 2007). 

[4] Federal Preparedness Circular 65 is guidance to the federal 
executive branch for use in developing viable and executable 
contingency plans that facilitate the performance of essential 
functions during any emergency. 

[5] The FEMA Operations Center is responsible for, among other things, 
facilitating information sharing between FEMA and non-FEMA
entities, and providing a status of on-going incidents, responses or 
potential events, during an emergency. 

[6] An alternate facility provides a physical location from which to 
conduct essential functions if the agencyï¿½s usual facilities are
unavailable. 

[7] DHS, National Response Plan (Washington, D.C.: December 2004). 

[8] GAO, Department of Homeland Security: Observations on GAO Access to 
Information on Programs and Activities, GAO-07-700T (Washington, D.C.: 
Apr. 25, 2007). 

[9] Participating agencies may have addressed these capabilities in 
other tests and exercises conducted during the year, which were outside 
the scope of our review. 

[10] FPC 65 states that agency personnel must have access to and be 
able to use electronic and hard-copy records and information systems 
needed to perform their essential functions. 

[11] GAO, Continuity of Operations: Agency Plans Have Improved, but 
Better Oversight Could Assist Agencies in Preparing for Emergencies, 
GAO-05-577 (Washington, D.C.: Apr. 28, 2005), and Continuity of 
Operations: Selected Agencies Could Improve Planning for Use of 
Alternate Facilities and Telework during Disruptions, GAO-06-713 
(Washington, D.C.: May 11, 2006). 

[End of section] 

To view the full product, including the scope
and methodology, click on [12]GAO-08-185 .

For more information, contact Linda Koontz at (202) 512-6240 or
[email protected].

Highlights of [13]GAO-08-185 , a report to the Ranking Member, Committee
on Oversight and Government Reform, House of Representatives

November 2007

CONTINUITY OF OPERATIONS

Selected Agencies Tested Various Capabilities during 2006 Governmentwide
Exercise

To ensure the availability of essential government services in
emergencies, federal agencies are required to develop continuity of
operations (COOP) plans. The Federal Emergency Management Agency (FEMA),
under the Department of Homeland Security (DHS), is responsible for
disseminating guidance to federal agencies on developing plans, as well as
conducting government-wide exercises every other year to assess federal
continuity readiness. In June 2006, FEMA conducted an exercise called
Forward Challenge 06, to allow agencies to activate COOP plans, deploy
essential personnel to alternate facilities, and perform essential
functions.

GAO was asked to describe the extent to which agencies tested continuity
plans and procedures, personnel, and resources during the June 2006
exercise. To do this, GAO selected the eight civilian agencies with
significant responsibilities during national disasters, analyzed agency
exercise documentation, and interviewed officials to determine which test
and exercise activities each agency included in its participation.

[14]What GAO Recommends

GAO recommends that FEMA require agencies participating in future
governmentwide exercises to document the specific test and exercise
activities conducted. In commenting on a draft of this report, DHS agreed
with GAO's recommendation and stated that it intends to refine its
assessment program and improve the level of evaluation documentation.

During Forward Challenge 06, the eight agencies GAO reviewed performed
various test and exercise activities related to COOP plans and procedures,
personnel, and resources. In many cases, agencies provided documentation
to substantiate the specific test and exercise activities performed.
However, in other cases, agencies reported conducting such activities but
did not provide supporting documentation. Finally, agencies also reported
not testing or exercising certain capabilities during the exercise. In
these cases, participating agencies may have addressed these capabilities
in other tests and exercises conducted during the year, which were outside
the scope of GAO's review. The table below presents a summary of the
extent to which agencies conducted various test and exercise activities
during the governmentwide exercise.

Agencies' inability to substantiate many of the test and exercise
activities that they reported performing during Forward Challenge 06 was
due in part to the absence of specific guidance on what should be
documented in such exercises. While FEMA directed participating agencies
to document issues and requirements for corrective action, significant
findings, and important observations during the Forward Challenge 06
exercise, it did not require participating agencies to document the
specific activities from their test and exercise programs that they
conducted during the exercise. Without adequate records of what has been
tested during a major governmentwide exercise, agencies lack assurance
that they have adequately tested their continuity capabilities at the
frequency outlined in FEMA guidance, which may limit their ability to
fully evaluate their readiness to respond to a disruption. In addition,
adequate records can reduce the potential negative impact of turnover in
key personnel due to attrition or change in administration, and strengthen
agency internal control capabilities.

Agency Testing and Exercising of COOP Plans and Procedures, Personnel, and
Resources

                                                        Tested but Not tested
                     Test    and    exercise Tested and    not       during
Category          activities              documented documented exercise^a
Plans and         Essential Functions         4          4          0 
Procedures        Activation          and                             
                     Notification:                                       
                     Activation                  4          3          1 
                     Notification--COOP          3          4          1 
                     Personnel                                           
                     Notification--Non-COOP      1          5          2 
                     Personnel                                           
                     Notification--Alternate     2          2          4 
                     Facility                                            
                     Notification--FEMA          6          1          1 
                     Operations Center                                   
                     Debriefing                  8          0          0 
Personnel         COOP          Personnel     5          3          0 
                     Participation                                       
Resources         Interoperable                                       
                     Communications:                                     
                     Communications              8          0          0 
                     Capabilities                                        
                     Communication      with     6          2          0 
                     Internal Contacts                                   
                     Communication      with     4          4          0 
                     External Contacts                                   
                     Vital Records               6          2          0 
                     Backup Power                1          1          6 

Source: GAO.

^aParticipating agencies may have addressed these capabilities in other
tests and exercises conducted during the year, which were outside the
scope of GAO's review.

References

Visible links
  10. http://www.gao.gov.
  11. mailto:[email protected]
  12. http://www.gao.gov/cgi-bin/getrpt?GAO-08-185
  13. http://www.gao.gov/cgi-bin/getrpt?GAO-08-185
*** End of document. ***