Background

		The Internal Revenue Service

IRS’s mission is to provide America’s taxpayers top-quality service by  helping them understand and meet their tax responsibilities and by  applying the tax law with integrity and fairness to all. To fulfill this  mission, IRS has more than 100,000 employees deployed among more than  600 offices nationwide and in select international cities. Some of these  offices are part of eight IRS campuses, which have the physical facilities  for processing tax forms and some of the facilities to respond to customer  inquiries. In response to the increased electronic filing of taxes, IRS is  consolidating the physical facilities it uses for processing tax forms, also  called processing centers. The rest of IRS’s work is completed in  noncampus offices and on-site at taxpayer offices, such as large  corporations.
Following the IRS Restructuring and Reform Act of 1998, IRS organized  itself into four business units to serve different types of taxpayers. The  Wage and Investment (W&I) business unit works with individual  taxpayers; the Small Business/Self-Employed (SB/SE) business unit works  with full or partially self employed individuals and small businesses; the  Large and Mid-Size Business (LMSB) works with corporations and  partnerships with assets greater than $10 million; and the Tax Exempt and  Government Entities (TE/GE) business unit works with employee plans,  tax exempt organizations, and governments.

		Organizational Resilience

The concept of resilience has gained particular importance and application  in a number of areas of federal planning. Both the Congress and executive  branch agencies have addressed resilience in relation to the importance of  the recovery of the nation’s critical infrastructure from damage.  Accordingly, most of the current focus is on assets, systems, and networks  rather than agencies or organizations. In February 2006, the Task Force of  the Homeland Security Advisory Council defined resiliency as “the  capability of a system to maintain its functions and structure in the face of  internal and external change and to degrade gracefully when it must.”  Later in 2006, the Department of Homeland Security’s National  Infrastructure Protection Plan—again focusing on critical infrastructure,  not agencies—defined resilience as “the capability of an asset, system, or  network to maintain its function during or to recover from a terrorist  attack or other incident.” In May 2008, the House Committee on  Homeland Security held a series of hearings focusing on resilience at  which government and private sector representatives, while agreeing on  the importance of the concept, presented a variety of definitions and  interpretations of resilience. For the purposes of this report, when we  discuss resilience, we will be referring to organizational resilience.
At the agency level, the current focus is primarily on continuity of  operations and the recently issued Federal Continuity Directives.  According to the Federal Continuity Directive 1, “an organization’s  continuity capability—its ability to perform its essential functions  continuously—rests upon key components and pillars, which are in turn  built on the foundation of continuity planning and program management.”  The Federal Continuity Directive states that an organization’s resilience is  directly related to the effectiveness of its continuity capability. In contrast  to continuity of operations, organizational resilience looks at more than  just essential functions, and accordingly, we have developed the five  categories described below.

	Some Organizational Attributes Can Contribute to Resilience

Because there is no widely accepted definition, we defined organizational  resilience for the purposes of our report and developed a framework to  assess a federal agency’s resilience. Organizational resilience is the quality  that would enable an organization to restore itself or thrive following a  disruption that has the potential to substantially compromise the  organization’s ability to accomplish its mission. A highly resilient  organization is identified by the speed and agility it demonstrates in  achieving a return to its normal state (or new normal state) and its  resulting enhanced ability to respond to future disruptions.
To make our definition of organizational resilience more practical and  observable, we identified 21 attributes particularly associated with  resilience and assigned them to five related categories. These categories  provide a useful assessment framework. (See figure 1.) These related  categories are    networked organizations.
However, whatever assessments are undertaken, it is important to note  that the severity or circumstance of a particular disruption to an  organization may be so severe or unusual as to make recovery not  attainable even if the organization has evidenced attributes of resilience  prior to the disruption. Similarly, given the specific nature of the  disruption or the specific circumstances of the disruption, perhaps one  attribute relative to others may prove particularly useful in helping the  organization to recover successfully.
The attributes associated with organizational resilience are discussed in  summary below and each attribute is discussed in greater detail in  appendix II.

		Emergency Planning

Emergency planning identifies disruptions that could potentially affect an  organization and defines and tests strategies to face those disruptions or  similar challenges. For example, in 2004, the Federal Emergency  Management Agency’s (FEMA) Hurricane Pam exercise simulated a  category 3 hurricane. In the exercise scenario, 15 to 20 feet of water  inundated New Orleans. This scenario was similar to the actual conditions  of Hurricane Katrina. Based on this exercise, FEMA was able to implement  some strategies which proved helpful during Hurricane Katrina, such as  FEMA’s working with hospital and university officials to create temporary  medical operations around the state. However, FEMA’s exercise also  identified other problems that it did not address, such as the need to plan  for evacuating those with special needs.

		Organizational Flexibility

A resilient organization has a workforce that can respond to a range of  disruptions with appropriate purpose, initiative, and comfort with change.  One aspect of organizational flexibility is an ability to accept change as a  learning opportunity. For example, the 9/11 Commission report criticized  the Federal Aviation Administration for failing to consider in its planning  the possibility of certain types of terrorist attacks. Specifically, the  commission determined that if the agency had examined a possible suicide  hijacking and reviewed existing security provisions, they could have  identified vulnerabilities. According to the commission, agencies tend to  accept the status quo, and accept that efforts to identify or fix certain  vulnerabilities are too costly, controversial, or disruptive to fix. This  inability to tackle necessary change can leave an organization with  unaddressed vulnerabilities, as was the case with the Federal Aviation  Administration.
Additionally, knowing when to change rules helped give federal agencies  access to additional resources during the Year 2000 (Y2K) Computing  Challenge. Specifically, increased latitude with human capital practices in  the federal government allowed agencies to access a larger pool of skilled  employees that could be allocated as needs arose. The Office of Personnel  Management recognized that personnel would need to be increased to  meet Y2K compliance and provided additional, more flexible hiring  authorities for agencies who needed employees to work on the  conversion. This included changing some authorities for re-hiring federal  retirees, exceptions on limitations on premium pay, and providing  retention allowances. Prior GAO work credited creative human capital  decisions and an adequate pool of human resources as contributing to the  federal government’s ability to meet the Y2K challenge.

		Leadership

Leaders who demonstrate respect for their employees and are accountable  for results are more likely to garner the employee commitment that will be  needed after a disruption that substantially compromises the  organization’s ability to accomplish its mission. Additionally, when  leadership abilities are distributed broadly through the workforce, an  organization is more likely to be resilient. For example, the Senate  Homeland Security and Governmental Affairs Committee found that, after  Hurricane Katrina, the Coast Guard had empowered front-line leaders to  make decisions when they needed to be made, which it found was perhaps  more important to their resilience than their regular training. Also, once it  was known that the September 11 hijackers entered the United States on  valid visas, the Department of State devolved leadership authority by  empowering consular staff to distinguish legitimate visitors from potential  terrorists through antiterrorism training, access to databases with names  of potential terrorists, foreign language training, and more staff to handle  the workload.

		Workforce Commitment

Within a workforce that is committed to the organization, individuals are  motivated to make significant personal investments and provide the  knowledge that may be necessary for organizational success following a  disruption. One aspect of employee commitment is understanding the  ways that the organization works. One expert referred to this attribute as  the ability to “have the organization in your head.” For example, a  bipartisan House of Representatives committee reported after Hurricane  Katrina that a lack of understanding of the command and control structure  among employees slowed and complicated the response effort after the  hurricanes. Another key aspect of this category is a workforce with the  needed skills to meet the organization’s mission. The committee report  also noted that, after Hurricanes Katrina and Rita, the Department of  Homeland Security and FEMA were not prepared, in part, due to a lack of  experienced and trained staff.

		Networked Organizations

Solid internal and external networks can facilitate and strengthen other  resilience attributes. For example, having dependable connections will  likely expand and expedite an organization’s access to resources when the  organization is faced with a disruption. Specifically, being aware of  interdependencies, knowing when reinforcement is needed, and being able  to communicate among interdependent units can give an organization an  extended reach for information, resources, and advice. Furthermore, an  organization’s knowledge of its supply chain interdependencies can help  identify vulnerabilities, which can inform risk assessments and emergency  planning. For example, after the terrorist attacks of September 11, 2001,  many companies in the financial sector found that they relied on the same  electronic data system backup sites, which were also affected by the  attacks. As a result, key institutions realized that their individual plans for  preparedness for disasters or other crises significantly affected others,  both directly and indirectly. Accordingly, the Securities and Exchange  Commission recommended that financial institutions explore the  usefulness of coordinated testing of plans. Additionally, the Y2K  challenge was met through the collaborative efforts of the Congress, the  administration, federal agencies, state and local governments, and the  private sector. Had any of these sectors failed to take the Y2K problem  seriously, neglected to remedy computer systems, or failed to work  together with partners on common issues such as contingency planning,  critical services could have been disrupted.
Although these five categories of attributes contribute to organizational  resilience, all disruptions are individual situations and even a relatively  resilient organization may not be able to restore operations under certain  circumstances. Furthermore, during a disruption, some attributes may  prove to be more important than others. For example, IRS found that, after  the 2006 flood of IRS headquarters, IRS did not have to activate its  headquarters continuity of operations plan. Alternate work space was  quickly made available for all headquarters employees, so identifying  critical personnel, a required step of continuity of operations planning,  was much less important. Additionally, with many attributes, excess of a  positive attribute becomes negative. For example, too much experience  with change could make employees suffer from innovation fatigue and  become less open and receptive to change.

	Lessons Learned Enhance IRS Resilience, but Current Emergency Planning Could Cover a Wider Range of Disruptions

IRS has a record of responding to external events, which have offered  lessons and opportunities for IRS to strengthen practices that enhance  resilience. The examples below show how IRS was able respond to  unanticipated external events because it had learned from prior  experiences.
IRS was able to improve the speed of its response to disruptions by  adapting its information technology processes. After Hurricanes Katrina  and Rita in August and September 2005, IRS deployed more than 5,000  employees at its call sites to help register disaster victims with FEMA.  During the response effort, IRS officials estimated that IRS staff may have  handled more than 50 percent of FEMA’s calls. In order to fill this  increased need for capacity, IRS expanded the size of its workforce by  bringing back about 4,000 seasonal employees, who are typically hired to  assist with the tax filing season. IRS completed a similar service for  FEMA during Hurricanes Ike and Gustav in 2008, and was able to  incorporate lessons learned from the response to Hurricanes Katrina and  Rita. Specifically, during the response to Katrina and Rita, IRS employees  were able to log into either the IRS system or the FEMA system but not  quickly able to transition between the two to serve the needs of the  individual callers. After this experience, IRS’s information technology staff  identified ways for IRS employees to toggle between the two systems and  thus work where demand was greatest.
IRS implemented lessons from past stimulus payments and delivered a  generally successful tax filing season. During the peak of the 2008  taxpayer filing season, IRS also had to process payments to taxpayers as  directed by the 2008 economic stimulus legislation. IRS processed  stimulus payments totaling $94 billion and handled more than twice as  many calls from individuals looking for assistance than they received in  2007. In addition, IRS processed almost 9 million “economic stimulus  only” tax returns from individuals who would not otherwise have had to  file a return. Because many of these individuals had never filed a return,  the error rate on these returns was higher than usual. Because of the  timing of the economic stimulus package, IRS did not have time to hire,  conduct background checks for, and train additional staff to handle the  increased volume of telephone calls for taxpayer assistance. Instead, IRS  maximized the use of its workforce by asking its compliance staff to  answer incoming calls from taxpayers about the stimulus. IRS knew the  adjustments that it would have to make to its workforce based on its  experience implementing past economic stimulus bills. As a result, even  with this increased workload, IRS was also able to deliver a generally  successful filing season. Nevertheless IRS had to make trade-offs in other  key areas. As a result of decisions to shift staff from collection cases to  telephone assistance, IRS estimated that its costs and foregone revenues  would reach up to $960 million.
IRS has been generally successful in the face of past disruptions. However  valuable these experiences have been, though, they can not provide  experiences for all possible disruptions nor provide experience to all IRS  employees. For example, an influenza pandemic, in which a large portion  of the workforce could be absent from work for extended periods, would  entail a different type of response from the experiences required by past  events. Accordingly, IRS relies on its emergency planning process and its  test and exercise plans to assist in preparing for disruptions it has not yet  experienced.

		A Full Range of Tests and Exercises Is Not Included in IRS’s Strategy

IRS’s test and exercise strategy focuses on four types of tests and  exercises. First, call tree tests check the accuracy and completeness of  contact information for key emergency personnel. Second, IRS staff  annually check that all four types of IRS business continuity plans are up  to date and accurate. Third, key emergency response personnel from  each business unit are required to complete a tabletop exercise in which  they familiarize themselves with the business resumption plan, their roles  within the plan, and the steps they would take in case of an emergency.  Participants in the tabletop exercise then walk through possible scenarios  to discuss ways they would respond. Last, in large geographic areas,  emergency personnel from multiple business units participate together in  an integrated tabletop exercise. The goal of the integrated tabletop  exercise is to provide a better understanding of how emergency response  personnel from different organizations work together and identify the  required time needed for resumption and recovery activities.
The tabletop exercises—while required agencywide since September  2006—are not regularly conducted. TIGTA found that more than half of  the business resumption plans they sampled had not been tested through  tabletop exercises in calendar year 2007. In addition, IRS officials noted  that the tabletop exercises are not always well designed. For example,  they said that one tabletop exercise presented so many scenario events  that participants found the exercise to be unrealistic and, during the  exercise, chose to decrease the number of scenario events and the  duration of the exercise. In response to the need to improve exercises  across IRS and implement new requirements from the Federal Continuity  Directives, IRS assembled its Emergency Management and Preparedness  Working Group, which coordinates emergency activities among its  business units, for a 2-day workshop. With the goal of reducing the  variation in the quality of the tabletop exercises, the workshop leaders  discussed and encouraged sharing among all the participants of how to  prepare and conduct successful tabletop exercises. Headquarters has  also recently made additional resources available to assist the business  units with implementing the tabletop exercises. For example, they recently  established the Incident Management Business Resumption Group as a  resource available to the business units to plan and conduct training,  testing, and exercises.
In addition to tabletop exercises, FEMA has identified and recommended  two additional types of tests and exercises:    Functional exercise: fully simulated interactive exercise that tests the  capability of an organization to respond to a simulated event. This type of  exercise strives for realism, short of actual deployment of equipment and  personnel.
Full-scale exercise: a simulated emergency event, as close to reality as  possible. It involves all emergency response functions and requires full  deployment of equipment and personnel.
The value of exercises that involve simulation was underscored by the  experts we interviewed. They noted that a resilient organization provides  opportunities for employees to respond to stressful circumstances. The  simulations involved in these types of exercises create more realistic  conditions and a better experience to prepare employees to contend with  an actual emergency event.
The senior IRS official responsible for emergency preparedness believes  that these more in-depth tests and exercises would be beneficial because  they would stretch IRS leadership and emergency personnel to confront  and learn from more realistic challenges. As part of this discussion, he  acknowledged that these more extensive tests and exercises are more  expensive than tabletop exercises and require a significant time  commitment from agency personnel. Accordingly, he thought that it would  be better to initially implement these tests on a limited pilot basis.
According to the experts we interviewed, some of the benefits of a  functional or full-scale exercise may be accomplished with the investment  of fewer resources, by simply making routine drills more stressful by  taking steps such as withholding an expected resource. For example, one  IRS campus held a fire drill in which use of cell phones was prohibited.  This experience taught employees to practice different modes of  communication and to use “runners” to spread information among  employees. This same campus held an additional evacuation drill where  selected employees remained in the building during the drill to test the  ability of the employees tasked with assuring the building was cleared of  occupants to locate missing employees.

	IRS’s Redundant Facilities and Telework Capabilities Increase Resilience

IRS has a strategy to build resilience through geographic dispersion of  leadership, data systems, personnel, and other capabilities. Accordingly,  IRS’s campus operations are carried out at eight locations across the  country; each campus has the capability to handle taxpayer calls and  process tax returns. (See figure 2.) The network of IRS campuses is  geographically dispersed and also highly redundant in function. IRS  officials have stated that, after a disruption, all campus operations could  be transferred to another campus if needed. Also, work is routinely shifted  among campuses if the workload of one campus exceeds the campus’s  capacity.
IRS has made strategic decisions based on the importance of flexibility to  its overall resilience. Specifically, to reduce unneeded capacity caused by  the increase in the number of taxpayers submitting tax returns  electronically, IRS is in the process of consolidating its total number of  paper processing centers. However, in considering the optimal number of  paper processing centers to retain for individual returns, IRS officials used  an analysis of the potential effects, in the face of an emergency, of losing  some campus redundancies. Based on this analysis, IRS will keep three— rather than two—individual tax return sites open. When combined with  two paper processing centers for small business tax returns, IRS will have  a total of five centers that process paper tax forms, making it better able,  in its view, to maintain the degree of flexibility that it needs for resilience.
In other IRS operations that do not require as much access to IRS  equipment and facilities, distributed capacity is achieved through moving  work among a dispersed workforce. To move work among noncampus  employees—who typically work in field offices or on site with a  taxpayer—the business units have developed electronic case management  files and have given employees access to laptops so that work can be  completed from any site. This is important because, in many cases, the  work of the noncampus employees is highly specialized, and accordingly,  IRS officials said that they preferred to keep workload within a business  unit after a disruption rather than redistributing it to other business units.
In contrast, the call center operations are routinely shifted among  individuals—located at 26 call sites nationwide—who respond to taxpayer  questions. The Joint Operations Center, located at the Atlanta campus,  routes incoming calls for taxpayer assistance to available assistors. This  center monitors the number of calls and customer waiting times and  distributes calls across its nationwide network of call centers. This  process allows IRS to ensure that taxpayer calls are promptly answered by  directing the workload to the first available individual who is able to  provide taxpayer assistance. Furthermore, the Joint Operations Center  itself is redundant; another fully capable Joint Operations Center is  located in Memphis, Tennessee.
Within a campus, many employees can perform multiple tasks and can be  reassigned within the campus as needed. As workload needs change,  employees are routinely shifted between managing telephone and paper  correspondence from taxpayers. Furthermore, as needed, employees who  process paper returns are routinely shifted between jobs, such as sorting  or examining envelopes to ensure that checks have not been left behind.  This provides the flexibility needed for the campus operations to respond  to change.
In past disruptions, IRS has used its seasonal workforce to respond to  changing circumstances. IRS has a seasonal workforce of about 30,000  workers, who are needed to assist IRS as the workload increases during  tax filing season. IRS contacts seasonal employees needed for each day’s  workload, allowing the IRS campus workforce to expand and contract as  needed. During emergencies, IRS has called on these employees for other  purposes as well. For example, as discussed above, IRS called on 4,000  seasonal workers to assist FEMA in responding to calls for assistance after  Hurricanes Katrina and Rita.
IRS has also demonstrated the ability to be flexible after disruptions and  reallocate physical resources quickly. For example, as a result of a flood at  IRS headquarters building during a period of record rainfall in June 2006,  the building sustained extensive damage to its infrastructure, and critical  parts of the building’s electrical and mechanical equipment were  destroyed or heavily damaged, requiring the headquarters building to be  closed until December 2006 to allow for repairs. Within 1 month of the  flood, over 2,000 employees normally assigned to the headquarters  building were relocated to 15 other locations throughout the Washington,  D.C., metropolitan area.

	IRS Has Many Systems to Build Leadership, Accountability, and Commitment in Its Employees

IRS has many systems in place to develop its overall leadership capability.  Among these are readiness programs to develop managers and executive  leadership (see table 1 for details). Through coursework and—in the case  of executive development programs—rotational opportunities, these  programs are designed to help employees develop leadership skills and  assess whether a manager position fits their career interest and abilities.  Participants can learn about and try manager competencies without  committing to a position, and managers can identify talented future  managers without promising every participant a manager position. After  completing a program, interested participants are selected for positions on  a competitive basis. Not only are these programs intended to help address  IRS’s projected need for managers, they allow nonmanagers to be trained  in leadership skills, which distributes leadership skills throughout the IRS  workforce and could be helpful in assisting IRS during a disruption. For  the past five years, the IRS Commissioner and Oversight Board have  received quarterly updates on the percent of managers completing these  programs in a timely manner. We have reported that attention from high  level agency officials to training initiative performance measures can  directly contribute to the development of employees who are capable and  motivated to accomplish the agency’s mission and goals. Accordingly,  based on the performance information he has received, the IRS  Commissioner determined that employees would be better able to fulfill  agency needs by making adjustments to IRS’s criterion for timeliness.  Specifically, IRS managers are now expected to receive training before or  within 9 months of their promotion, a shorter time frame than was the  case in the past.
IRS’s performance management system is structured to build employees’  understanding of the organization’s mission and values and their roles  within the organization. Through the performance management system, all  managers are expected to set employee expectations and align these  expectations with the IRS mission and strategic objectives. We have  reported that an explicit alignment of employee expectations with broader  organizational goals is a defining feature of an effective performance  management system in high performing organizations. We have noted that  these organizations use their performance management systems to  improve performance by helping individuals see the connection between  their daily activities and organizational goals, and this type of system  encourages individuals to focus on their roles and responsibilities to help  meet their goals. Accordingly, IRS employees have communicated  through employee interviews and surveys that they know their roles in the  organization’s mission. The 2008 IRS Employee Survey found that more  than 85 percent of respondents IRS-wide agree with the statement, “I know  how my work relates to the agency’s goals and priorities.”
Managers are also held accountable for the engagement of the employees  whom they supervise, an asset to resilient organizations. All managers are  held directly accountable for their workgroup’s score on an Employee  Engagement Index, which is based on the annual IRS Employee Survey.   (See table 1 for details.) IRS defines employee engagement as the degree  of employees’ motivation, commitment, and involvement in the mission of  the organization, and has created IRS-wide annual targets to increase  engagement scores. Managers of workgroups that receive a score in the  bottom 10 percent of all IRS workgroups are automatically enrolled in the  Leadership Coaching Program. (See table 1 for details.) The coaching  program is intended to give these managers greater tools for improving or  addressing employee concerns. Managers in all four IRS business units  broadly praised the program. Additionally, according to IRS, scores on  questions in the engagement index improved by almost 40 percent  between 2007 and 2008 for workgroups with managers in the coaching  program.
Another IRS-wide initiative aimed at bolstering management  accountability for employee engagement is ES Tracker. (See table 1.)  Issues from the Employee Survey, workgroup issues, or other concerns  are entered into a database by workgroup managers. Managers are  responsible for taking action on the items or elevating them up the  management chain until an individual or committee addresses the issue.  For example, in a recent meeting of one workgroup, current employees  expressed frustration with the skill sets of newly hired employees. They  mentioned a past practice that included an additional level of screening  before hiring employees, and asked that management explain why this  screening was no longer in place. This question was entered into ES  Tracker and elevated for management to address. Through ES Tracker,  employees have also shared new and useful technologies to make work  more efficient and improve taxpayer relations. For example, workgroups  identified the need for financial market data terminals which would assist  IRS staff. The employees said that the software would validate source  information that taxpayers provided to TE/GE revenue agents. These  technologies were provided to workgroups after management was alerted  through ES Tracker. The Human Capital Office can track trends in the  system across IRS. This transparency helps increase accountability by  allowing employees to see what issues management has addressed.
Although IRS has a number of programs in place to build staff motivation,  less than half of respondents in the 2008 IRS Employee Survey agree with  the statement, “In my organization, leaders generate high levels of  motivation and commitment in the workforce.” This is lower than the  percentage of IRS employees responding positively to most other survey  questions, with which an average of more than 65 percent agreed.  According to IRS managers, this response may be due to the geographic  dispersion of IRS offices and hierarchical distance between employees and  leadership. In many cases, IRS employees will only see IRS senior leaders  once a year, if at all. Many of the IRS managers we talked to expressed  concern about this disconnect and have developed individual methods in  addition to the IRS and division initiatives to bridge the geographic and  professional distance between leadership and frontline workers. Managers  and leaders have reported including their pictures on e-mail messages,  creating intranet pages to communicate with employees, and making visits  to IRS sites. Formal initiatives include town hall meetings, which are run  by IRS leadership and provide employee exposure to senior leadership and  a forum for leadership to address employees. Additionally, E-talk, a Web- based comment submission system, allows employees in one business unit  to anonymously share positive and negative comments directly with senior  leadership. IRS has included this survey question in the above discussed  employee engagement index, and accordingly, the steps taken in response  to the index—such as the coaching initiative—may affect this score.

	IRS Has a Number of Networks but Could Include Stakeholders to a Greater Extent

Despite IRS’s large size and distributed workforce, there are many formal  ways for employees to communicate across different parts of the agency.  At the time of our review, IRS had a number of cross-business-unit  initiatives, including over two dozen internal advisory committees to  address human capital, technology, security, and other operational issues.  Also, business units have established working groups, as needed, to  address cross-functional tax administration issues, and in some cases,  teams of employees from multiple units do the work.
Some of IRS’s formal and informal human capital practices further  enhance internal networks. Formally, participants in the Executive  Readiness Program may complete assignments in other units of IRS. This  helps employees make contacts throughout the agency and observe the  operations of other units, which may better enable them to call on others  for assistance in the face of a disruption. IRS is also developing  corporatewide training for its Revenue Agent staff, a position that is  common to many of the business units. The training will help employees to  make contacts throughout the agency. Many IRS employees move between  business units during their careers. For example, IRS’s Workforce Plan  shows that it is common for SB/SE employees to move to LMSB.
IRS also works with a number of outside groups. Table 2 highlights  examples of such groups.
Federal Continuity Directive 1 requires that agencies perform annual tests  of the internal and external interdependencies identified in their continuity  plan, with respect to performing mission-essential functions. Agencies  are also required to have an opportunity to demonstrate inter- and intra- agency communication capabilities and to test equipment used in internal  and external communication. However, the Federal Continuity Directive  does not specify whether representatives of external entities need to be  present at the tests and exercises, or whether they can simply be  represented by agency personnel. IRS is currently implementing the  requirements from the Federal Continuity Directive.
IRS guidelines require business units to include internal stakeholder  groups in tests and exercises but do not have parallel requirements for  external stakeholder groups. Internal groups include Modernization and  Information Technology Services and Agency Wide Shared Services that  move resources throughout IRS and provide services necessary for  employees to do their jobs. Internal interdependencies are tested through  integrated tabletop exercises, which IRS requires for large geographic  regions as part of its annual test and exercise strategy. However, IRS  currently has no requirement for including external stakeholders in tests  and exercises. As a result, tests and exercises involving these entities have  been inconsistent across IRS. The few IRS exercises involving external  entities tend to be centered on a large city or on IRS campuses.
In the exercises in which external partners participated, IRS benefited by  identifying important lessons to integrate into its plans. In one case, IRS  held an integrated tabletop exercise with FEMA and the Central U.S.  Earthquake Consortium—an educational organization that coordinates  multistate efforts in emergency planning for an earthquake in the central  United States—where IRS managers and Business Resumption Plan  coordinators reacted to a detailed earthquake scenario. FEMA was able to  provide IRS with a specific impact analysis on its facilities, which showed  that the affected area would be much larger than IRS had anticipated. As a  result of the exercise, IRS recognized that an alternative computing site  would be unusable after an earthquake, and now plans to relocate the site.  In some cities, IRS also participates in exercises hosted by the local  Federal Executive Boards that bring together federal agencies located in  the same city. By participating in an Atlanta Federal Executive Board  exercise, IRS was able to establish important contacts with local  government officials.
However, even in campus locations, some exercises occur without  participation from external entities. For example, IRS’s Atlanta campus  has its own on-site post office, and is co-located with the Centers for  Disease Control and Prevention, but neither the post office nor the  Centers for Disease Control and Prevention participates in IRS exercises.  In a recent exercise, participants from IRS have discussed the possible  response of the post office, but postal representatives were not included in  the tabletop exercises.
By not having regular external participation in tests and exercises, IRS  missed several opportunities for strengthening ties that could play a  critical role during a disruption. For example, an SB/SE office in New  Jersey that faced a possible anthrax contamination learned that the local  authorities on whom IRS relies in such situations were ill prepared and  even unaware of how to put on protective suits. Rather than learning these  deficiencies during a no-risk situation, such as an exercise, IRS identified  the local authorities’ lack of preparedness during a situation that could  have proved harmful.
The need to include stakeholders is particularly relevant for providers of  electronic tax software and Electronic Return Originators. As we recently  reported, electronic tax software and the associated electronic return  originators, which electronically submit returns to IRS, are key to the tax  administration system. In 2007, 39 million tax returns were prepared  using commercial software and the majority of electronically submitted  returns went through electronic return originators. Even though these  organizations are a critical component of the tax administration system,  they are not formally included as part of IRS’s test and exercise strategy.  We recently recommended that IRS develop and plan for effectively  monitoring compliance with recommended security and privacy standards  for the 2010 filing season. We should note, however, that with one recent  exception which did not have a significant effect, tax software companies  have been generally reliable providers of electronic filing services.

	Conclusions

In the face of tax law changes and natural disasters, IRS has exhibited a  considerable degree of resilience. After these experiences, it has also  demonstrated it is able to incorporate lessons from these past disruptions  into its planning and policies. IRS’s strategic flexibilities and tools to  distribute leadership capabilities through the workforce and hold  individuals accountable are additional ways that IRS builds its capacity for  resilience.
While IRS has been generally successful in the face of past disruptions, its  current test and exercise strategy does not include simulations of real  events through functional or full-scale exercises, which limits the ability of  IRS staff to gain experience in responding to more realistic circumstances.  Realistic and stressful circumstances are important to include in tests and  exercises, because they build in employees the capacity to respond to the  stress of actual events. At the same time, functional and full-scale  exercises require greater financial and staff investment than do tabletop  exercises. Accordingly, these types of tests and exercises could be done  on a limited basis and the results evaluated to assess the costs and  benefits before conducting them more widely. At the same time, stressful  circumstances can still be included in routine drills, which affect a wider  range of employees than specific planning exercises, with a lower cost and  less time commitment.
Furthermore, the innovation required in the face of some disruptions  includes knowing how to draw on the agency’s own resources and the  resources of others. This capacity cannot be achieved with simple  planning exercises alone or in isolation, but requires individuals to have  the opportunity to practice responding to stressful circumstances with key  stakeholders.

	Recommendations

To improve the resilience of IRS operations, we recommend that the  Commissioner of the Internal Revenue Service direct the appropriate  officials to take the following three actions:  1.  Establish a plan to conduct a limited number of functional or full-scale  exercises to include IRS leadership and emergency personnel. These  tests and exercises should be followed by an evaluation of their costs  and benefits. Based on the evaluations, IRS emergency plans should be  revised to reflect the degree to which the tests should be replicated  more broadly.  2.  Establish plans for the inclusion of some degree of stressful  circumstances in the routine evacuation and shelter-in-place drills in  which all IRS employees participate.  3.  Modify test and exercise standards to include involvement of external  stakeholders.

	Agency Comments and Our Evaluation

We provided a draft of this report to officials at IRS for their review and  comment. IRS’s comments are reproduced in appendix III. In its  comments, IRS agreed with all three of our recommendations.
As agreed with your offices, unless you publicly announce the contents of  this report earlier, we plan no further distribution until 30 days from the  report date. At that time, we will send copies to the Commissioner of the  IRS. The report also is available at no charge on the GAO Web site at  http://www.gao.gov.
If you or your staff have any questions concerning this report, please  contact me at (202) 512-6543 or steinhardtb@gao.gov. Contact points for  our Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. Major contributors to this report are listed in  appendix IV.

Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to    define organizational resilience and its dimensions,    determine the degree to which selected IRS field operations exhibit the  attributes of organizational resilience, and identify challenges and opportunities to improve organizational resilience  at IRS.
To define organizational resilience and the attributes of resilience we  reviewed academic literature from the fields of psychology, ecology,  organizational and management science, high-reliability organizations,  continuity, and disaster management, as well as relevant GAO and  Treasury Inspector General for Tax Administration (TIGTA) reports. In  addition, we interviewed 11 academic and practitioner experts—in  emergency preparedness and disaster management, management and  organizational psychology, critical infrastructure, and strategic planning— regarding organizational resilience. These experts were chosen based on  their publications, contributions to their field, and the frequency with  which other experts cited their work. Through an iterative process with  the experts, we developed a list of 21 attributes related to organizational  resilience. These attributes were then arranged into five broad categories:  emergency planning, organizational flexibility, leadership, committed  workforce, and networks.
To identify the ways that the Internal Revenue Service (IRS) exhibits the  attributes of organizational resilience and the opportunities that IRS has to  take on additional practices which would make it more resilient we  selected relevant parts of IRS, completed a document review, observed  organizational meetings, and held interviews with IRS officials. The four  business units of IRS were selected for review: Wage and Investment  (W&I), Small Business/Self-Employed, Large and Mid-Size Businesses, and  Tax Exempt/Government Entities. We selected these divisions because  their work fulfills the statutory authority of IRS. Additionally, we  examined the specific units and offices within IRS headquarters and  functional units which support the work of the business units including  the Human Capital Office, Agency-Wide Shared Services (AWSS), and  Modernization Information and Technology Services (MITS) office.
To learn about IRS practices which relate to organizational resilience, we  reviewed GAO and TIGTA reports, IRS documents, and interviewed IRS  representatives. For each of the four business units and IRS headquarters,  the Commissioner or designated representatives as well as representatives  from the offices of human capital and emergency planning were  interviewed. For the functional unit AWSS, representatives from the  offices of emergency planning, facilities management, and the Senior  Commissioner Representatives were interviewed. For the functional unit  MITS, representatives of relevant offices to organizational resilience,  including End-User Services and Cyber Security, were interviewed.  Representatives from the cross-IRS working groups of Workforce of  Tomorrow, Emergency Management and Preparedness Working Group,  and Security Services and Privacy Executive Steering Committee also  were interviewed. Additionally, we interviewed the president of the  National Treasury Employees Union.
To gain perspectives on the views and working relationships of IRS  employees, we reviewed survey data and observed selected meetings and  offices. We reviewed IRS Employee Survey results for 2007 and 2008; IRS  provided the raw data for these surveys to GAO. We determined that  available data were sufficiently reliable for the purposes of this report.  However, we should note that the response rate to the survey was about  60 percent, a rate which typically raises concerns about possible bias due  to nonresponse. To address this concern, we reviewed IRS’s response bias  analysis that had determined no adjustments were required to correct for  nonrespondents. In addition, based on the average positive response rate  of about 65 percent, we set a threshold for reportable positive responses  of more than 80 percent and a threshold for negative responses of less  than 50 percent, and selected only responses from those that exceeded  these thresholds. Additionally IRS provided documentation and analysis  related to the IRS Employee Engagement Index, which is based on the IRS  Employee Survey data. Furthermore, we observed IRS employees at the  Emergency Management and Planning Working Group monthly meetings;  the AWSS-sponsored Federal Continuity Directives 1 and 2 seminar for  emergency planning representatives from all IRS business, headquarters,  and functional units; and the W&I call center routing center, submissions  processing, and accounts management facilities.
We conducted this performance audit from January 2008 to April 2009, in  accordance with generally accepted government auditing standards. Those  standards require that we plan and perform the audit to obtain sufficient,  appropriate evidence to provide a reasonable basis for our findings and  conclusions based on our audit objectives. We believe that the evidence  obtained provides a reasonable basis for our findings and conclusions  based on our audit objectives.
We assessed the reliability of data used in this report by (1) performing  electronic testing of required data elements, (2) reviewing existing  information about the data and the system that produced them, and (3)  interviewing agency officials knowledgeable about the data. We  determined that the data were sufficiently reliable for the purpose of this  report.

Appendix II: Expanded Discussion of Organizational Resilience Attributes

Organizational resilience is the quality that would enable an organization  to restore itself or thrive following a disruption, by which we mean a  sudden and externally imposed circumstance that has the potential to  substantially compromise an organization’s ability to accomplish its  mission. A highly resilient organization is identified by the speed and  agility it demonstrates in achieving a return to its normal state (or new  normal state) and its resulting enhanced ability to respond to future  disruptions.
To make our definition of organizational resilience more practical and  observable, we identified 21 attributes that can be placed in five related  categories. We found that organizational attributes related to emergency  planning, organizational flexibility, leadership, workforce commitment,  and networked organizations are particularly associated with resilience  and provide a useful assessment framework. These characteristics can  help an organization be resilient after a disruption, but under certain  circumstances, even a relatively resilient organization might not be able to  recover. (See figure 3.)

	Emergency Planning

Emergency planning identifies disruption that could potentially affect an  organization and defines and tests strategies to face disruptions.

		Test and Exercise Requirements that Challenge Employees to Respond to Unexpected and Stressful Circumstances that Require Adjustments to Established Plans and Procedures

An organization that performs regular tests and exercises of their  emergency plans will likely better know how to handle a real disruption.  According to Federal Emergency Management Administration (FEMA)  training materials, an exercise is a practice that “places the participants in  a simulated situation requiring them to function in the capacity that would  be expected of them in a real event. Its purpose is to promote  preparedness by testing policies and plans and training personnel.” An  exercise program should include long-range goals, schedules, and roles  and responsibilities for executing the tests and exercises. Tests and  exercises should be challenging and include a variety of scenarios. As one  of our experts suggested, organizations should occasionally withhold an  expected resource, which forces participants to improvise and use  creativity.

		Incorporation of Lessons Learned from Tests, Exercises, and Past Disruptions into Its Emergency Plans

Aside from learning how to react to a scenario, tests and exercises are an  opportunity to expose flaws in plans. After a test or exercise, participants  should be debriefed and participate in a discussion about lessons from the  scenario. Resulting lessons should be incorporated into revisions to plans,  guidance, training or other related documents. Not implementing such  changes leaves organizations vulnerable to recommitting mistakes. To  demonstrate this attribute, an organization should have after-action  reports from tests and exercises, and documentation of implementing  changes that result from the reports.

		Management Decisions Based on Risk Assessments

An organization that is aware of its surroundings and takes its risks and  vulnerabilities into account during decision making could diminish effects  of a disruption. A couple of our experts emphasized the importance of  having realistic views of hazards and vulnerabilities, with one of them  emphasizing the need for identifying consequences and possible solutions.  Prior GAO work has defined risk management as a strategic process for  helping decision makers make decisions about assessing risk, allocating  finite resources, and taking actions under conditions of uncertainty. The  risk management process includes setting strategic goals, objectives, and  constraints; performing threat, vulnerability, and criticality assessments;  evaluating alternatives; selecting an alternative; and implementing and  monitoring decisions.

		Employees at All Levels and in Various Units and Locations of the Organization Who Are Involved in Emergency Planning Efforts

Aside from the content and implementation of plans, it is important for an  organization to have an open and participative process for creating  emergency plans. This includes acknowledging and, as appropriate,  including employee feedback in the planning process. Giving employees a  relationship with a plan helps ensure that they are familiar with it,  according to one of our experts. Evidence for this attribute could be found  in rosters of participants in emergency planning sessions or membership  lists of any planning committees, or documentation of any employee- initiated changes.

	Organizational Flexibility

A flexible organization that is receptive to change has a workforce that  can respond to a range of disruptions flexibly and with agility.

		Employees with Sufficient Breadth of Expertise to Contribute to Resumption Efforts in a Variety of Ways

When employees have a wide breadth of expertise and the ability to work  in different positions and areas of the organization, the organization has a  broader array of human resources to draw on and compensate for any  losses after a disruption. Employees with experience in different locations,  levels, units, or occupations within an organization likely have the type of  broad knowledge necessary to act quickly and fill in when an organization  is lacking in resources. Breadth of expertise can be obtained through  crosstraining, serving on details or rotations among different  organizational units, or by having different roles through natural career  progression.

		Redundant or Alternate Paths to Achieve Results

An organization with physical and human resources that are  geographically dispersed is more likely to be resilient because of an ability  to relocate operations should a facility need to close. An increased number  of pathways for operating decreases the effect of a disruption at any one  site. Redundancies can be physical or equipment-based, such as having a  field office structure, designating alternative sites, or having storage areas  for backup files or equipment that are not co-located with office sites.  Redundancies can also exist in human resources, meaning that more than  one employee is capable of performing a specific job should some  employees be unable to work. This attribute can be demonstrated through  the existence of multiple work sites and plans that identify alternative  sites and backup personnel.

		Financial, Physical, Information Technology, and Human Resources Managed with an Adequate Margin to Respond to Unexpected events

An organization’s breadth of expertise and distributed capacity will likely  be effective only if adequate assets are in reserve to support reallocating  employees and resources. Specifically, an organization needs the ability to  free employees, budget, and physical and technology resources during a  disruption, sometimes referred to as margin. Organizations with  overstretched resources and excessive workloads will likely find it  difficult to shift employees, finances, or office space into alternate  configurations. This attribute can be seen in looking at the organization’s  workload inventory, identification of any chronic staff shortages, or  assessments of how an organization works under budgetary constraints.

		A Culture that Encourages Employee Creativity and Innovation

Employees who have demonstrated an ability to think independently and  use creative problem-solving skills will likely be more resourceful and able  to improvise after a disruption. Organizations can encourage and facilitate  the development of these skills by giving employees opportunities to  propose solutions to workplace challenges, and to involve employees in  identifying improvements. An organization that supports these skills may  also offer related training, or it may have job descriptions or competencies  for employees that set performance expectations for their ability to think  creatively and apply new ideas. Similarly, the organization may recognize  employees who introduce new processes and ideas with awards that are  visible within the organization.

		A Culture that Encourages Acceptance of Change and Uncertainty as a Learning Opportunity

An organization that resists rigidity and accepts that improvements can  accompany change will likely be better able to address vulnerabilities,  respond with agility during a disruption, and thrive afterwards. This  includes having a tolerance for ambiguity and a willingness to keep  multiple options open when faced with decisions. Rigidity or an  overreliance on bureaucratic structures can increase vulnerability to  disruption and can paralyze an organization during a disruption.  Furthermore, after change occurs, the organization should be able to grow  its competence based on increased knowledge and experience. Observing  ways the organization has dealt with change or assessing the levels of  employee or outside involvement in decision making can serve as  anecdotal evidence for this attribute. Additional evidence might include  training on change management to employees, or job descriptions or  competencies for employees that set performance expectations for ability  to accept change.

	Leadership

Leaders who demonstrate respect for their employees and are accountable  for results are more likely to garner the employee commitment that will be  needed after a disruption. Additionally, when leadership abilities are  distributed broadly through the workforce, an organization is more likely  to be resilient.

		Treating Employees with Respect and Acknowledging the Needs of Employees

Leaders who understand and accommodate the needs of their employees  and acknowledge a necessary work/life balance, particularly after a  disruption, can increase resilience, as it is important to help resolve  employees’ personal problems because of the problems’ potential to affect  the workplace. As one of our experts stated, leaders should acknowledge  the emotion and uncertainties that surround an event, be realistic about its  effects, and have strong communication with employees. Respect could be  seen in availability of support or counseling services for employees after a  disruption, or through work/life balance provisions such as telework.

		Preparing Employees to Exercise Leadership When Necessary, which Includes Making Appropriate Decisions and, in Some Cases, Commitments on the Part of the Organization

As one of our experts said, leaders need to be empowered in a crisis to  take initiative and make logical decisions without fear of punishment. This  autonomy can come from a management style that encourages  independent action. An organization should have provisions that enable  individuals to exercise judgment, discretion, and to make and recover  from mistakes, according to one expert.

		Delegating Responsibility Based on Knowledge of Employee Skills and Past Work Experiences

Rather than strictly relying on hierarchy, leaders of a resilient organization  should delegate to enhance employee development and to maximize the  achievement of organizational goals. This requires an awareness of  employee strengths and skills. One of our experts emphasized the need to  devolve authority to the employees equipped to deal with a specific  situation and who know the work. Leaders must then support employee  decisions by granting autonomy and providing the necessary coordination  and resources. This attribute could be seen in managers’ use of horizontal  teams and task forces for decision making, and managers having a  knowledge and skills database to catalog special employee skills.

		Building an Empowered and Effective Workforce by Supporting Employee Achievement and Professional Development

An organization that supports continuing education, professional  development, and expanded leadership opportunities will be more likely  to be resilient. As one of our experts said, leaders can help employees  learn to have confidence in their ability to perform a task or achieve an  outcome. Competence is based on training, experience, and development  of specialized knowledge, and as competence grows so does one’s ability  to respond and recover from unfamiliar or challenging situations.  Opportunities for employees to further their professional knowledge and  experiences lead to increased confidence and competence.

		Holding Leaders Accountable for Results; Having Tools that Hold Staff Accountable for Results

Organizations with mechanisms to hold individual leaders accountable for  unit and organizational performance will likely have a pre-existing focus  on responsibilities for organizational accomplishments that will aid in  resilience. Accountability is especially important during catastrophic  disasters, as it helps to ensure that resources are used appropriately. Prior  GAO work has shown that performance management systems can help  reinforce individual accountability for organizational results. This includes  creating pay, incentive, and reward systems that link employee  knowledge, skills, and contributions to organizational results. In addition,  requiring and tracking follow-up actions on performance gaps and  requiring follow-up actions to address organizational priorities can  increase accountability.

	Workforce Commitment

A workforce that is committed to the organization provides individual  motivation to make significant personal investments and provide the  organizational knowledge that may be necessary for organizational  success following a disruption.

		Employees Who Understand and Are Committed to the Organization’s Mission and Values and Their Roles within the Organization

An explicit alignment of daily activities with broader results helps  individuals see the connection between their daily activities and  organizational goals and encourages individuals to focus on their roles and  responsibilities to help achieve those goals. This helps with employee  accountability, but can also provide employees with a sense of purpose,  both of which are an advantage for resilience. If an organization faces a  disruption and employees know their roles in achieving the organization’s  mission and goals, they will have organizational principles to guide their  actions. Leaders can dispense and reinforce this knowledge through  including specific goals in individual employee performance plans and job  elements, and updating employees on progress on organizational goals.
Not only should employees know their roles in the organizational mission,  but if they are committed to that mission there is an increased likelihood  that employees will extend themselves and give the organization  momentum during a disruption. According to one of our experts, the  commitment should be to the organization’s mission, not the organization  itself. Thus employees’ self interest should overlap with the interests of the  organization. This attribute can be observed through employee feedback  and employee involvement in organization-wide initiatives.

		Employees with the Skills Necessary to Meet the Organization’s Mission and Address Any Problems that May Arise

An organization that has few critical skill gaps will likely be better able to  meet the daily needs of the organization and those that could arise during  a disruption. Similar to having a workforce with a breadth of expertise, an  organization’s employees should have some universal skill sets beyond  those needed for their current duties. In the words of one of the experts  we spoke with, the more skills that an employee has, the more problems  they are able to see, thus enabling them to interact and intervene earlier  during a disruption; if someone is lacking in skills they will likely overlook  potential problems. Additionally, employees should be able to act under  ambiguous and unstructured circumstances. Organizations can  demonstrate this attribute by performing regular skill gap analyses and  taking steps to fill any deficiencies, by providing for continuous education  and career development, particularly through cross-functional  assignments or training.

		Employees Who Understand the Broader Implications of Their Work and the Downsides of Possible Failure, Who Demonstrate Appropriate Actions When Faced with Potential Disruptions

An organization that has an alert workforce and a culture in which  employees can call attention to errors will be better off during and after a  disruption. According to one author, employees in a resilient organization  need to seek and examine potentially disturbing information. This includes  doing scans of the environment and understanding the risks and priorities  of the organization; or, in the words of another expert, having a “broad  horizon.” The information gathered through situational awareness and  other sources helps inform the risk management process. An organization  can demonstrate this attribute by providing ways for employees to report  problems, and rewarding employees who identify and suggest ways to  address potential problems.

	Networked Organizations

Solid internal and external networks can facilitate and strengthen other  resilience attributes. For example, having dependable connections will  likely expand and expedite an organization’s access to resources when  faced with a disruption. Specifically, being aware of interdependencies,  knowing when reinforcement is needed, and being able to communicate  among interdependent units can give an organization an extended reach  for information, resources, and advice. Furthermore, an organization’s  knowledge of its supply chain interdependencies can help identify  vulnerabilities, which can inform risk assessments and emergency  planning.

		A Plan and Means to Communicate with Target Audience

Having a plan to communicate with employees, clients, and other  stakeholders in the event of a disruption will likely help an organization to  acquire and share information during a disruption, and correct any  misinformation. Communication with employees about the status of the  organization (i.e., building closures and leave policies) and any revised  expectations for performance can reduce uncertainty and help employees  adjust to change. Communication with clients about any changes in  service can help to manage reputations after a disruption. Communication  should occur through multiple formats, and should occur through a  designated official source. An organization can demonstrate this attribute  by having information hotlines or Web sites ready to disseminate  information, or by having a media relations public affairs office. Having  connections with partners or peer organizations could also prove helpful  in delivering a message.

		Formal and Informal Intra- organizational Networks

Collaboration and connections among employees can increase an  organization’s resilience by decentralizing information and decision  making, thereby strengthening knowledge, commitment, and problem- solving abilities. Networks throughout the organization can also help build  other resilience attributes. For example, employees’ ability to connect  with one other to access resources from other units or locations can  increase the organization’s distributed capacity and make better use of the  organization’s breadth of expertise. A collaborative and connected  workforce is also more likely to be aligned and committed to the  organization, according to a couple of our experts. This attribute can be  observed through the presence of cross-functional working groups,  classes, or information-sharing sessions.

		Clearly Identifying Critical Suppliers, Assessing Their Reliability, and Considering the Availability of Alternate Arrangements in Emergencies

Resilient organizations need a sense of where to go if there is a disruption  and no ordinary means to obtain resources, according to one expert. Both  internal and external interdependencies should be assessed as part of the  risk management process, and should be checked through tests and  exercises. An organization can demonstrate this attribute by having  contracts with backup suppliers, putting in supplier contracts  expectations during a disruption, and involving internal and external  entities in tests and exercises.

		Reliable Partnerships with Community and Peer Organizations; Employees Who Are Connected to Other Organizations Through Professional Associations and Networks

An organization that has a network of partners and alliances with other  organizations will likely have access to additional advice, help, and  resources during a disruption. Partners could include peer organizations,  professional organizations, government entities, or co-located  organizations. In addition to providing resources to increase an  organization’s margin, partners can provide employees with opportunities  to build breadth of expertise through professional contacts and programs,  they can provide feedback from customers, and they can give a broader  perspective on emergency preparedness. This attribute can be seen in  employee participation in professional organizations, employee  participation in conferences or external training, or formalized agreements  for resource sharing with other organizations.

		Overall Comments about the Attributes

All of these attributes contribute to potential organizational resilience but  do not ensure it, because all disruptions are individual situations and even  a resilient organization may not be able to restore operations after a  disruption. Furthermore, during a disruption, some attributes may prove  to be more important than others. For example, we found after the 2006  flood of IRS headquarters that IRS did not activate the headquarters  continuity of operations plan because of the specific conditions of the  flood. Specifically, alternate work space was available for all headquarters  employees within a relatively short period, reducing the importance of  identifying critical personnel, a required step of continuity of operations  planning. Additionally, with many attributes, there is the potential for  condition where the excess of a positive attribute becomes negative. For  example, too much experience with change could make employees suffer  from innovation fatigue and become less open and receptive to change.

Appendix III: Comments from the Internal Revenue Service

Appendix IV: GAO Contact and Staff Acknowledgements

	Staff Acknowledgments

In addition to the contacts listed above, William J. Doherty (Assistant  Director) and Mallory Barg Bulman (Analyst-in-Charge) supervised the  development of this report.
Lindsay Welter, Colleen A. Moffatt, and Daniel Berring made significant  contributions to all aspects of the report. James R. White and Neil A.  Pinney provided expertise on tax administration. Martin De Alteriis,  Beverly Ross, and Karen O’Connor assisted with design, methodology, and  data analysis. Sabrina Streagle provided legal counsel. Melanie H.  Papasian provided editing assistance. William Trancucci verified the  information in the report. In addition, Robert Love, John F. Mortin, and  James R. Sweetman made key contributions to this report.

Summary:
Why GAO Did This Study

The Internal Revenue Service (IRS) collects the revenues that fund the federal government and issues billions of dollars in refunds. Consequently, IRS's ability to demonstrate agility and speed in restoring its functions after a disruption is vital to the government and the economy. GAO (1) identified the definition and attributes of organizational resilience; (2) examined the extent to which these attributes are exhibited within IRS; and (3) reviewed the challenges and opportunities faced by the IRS in becoming more resilient. GAO gathered and analyzed the attributes of resilience based on discussions with academic and practitioner experts in the field. GAO then reviewed IRS human capital and emergency preparedness policies and strategic plans, observed campus operations and emergency working group meetings, and interviewed officials from headquarters and each of the four business units.

What GAO Found

Organizational resilience is the quality that would enable an organization to restore itself or thrive following a disruption that substantially compromises its ability to accomplish its mission. Five categories of attributes can help an organization be more resilient: robust emergency planning, flexible organizational assets that can be accessed during times of change, leadership capacity distributed through the organization, a committed and skilled workforce, and strong relationships with internal networks and outside organizations. Although each of these categories is important, the characteristics of whatever disruption an organization faces may make some attributes more valuable than others. In its emergency planning, IRS has learned from experiences requiring organizational resilience. For example, during the peak operations of the 2008 filing season, the economic stimulus legislation required that the IRS process stimulus payments totaling $94 billion. Through adjustments to the workforce, IRS was able to implement the change and delivered a generally successful filing season, while making key trade-offs. Although the IRS has learned from past events, its current test and exercise strategy is limited. Functional or full-scale exercises--which are not part of IRS's strategy-- provide more realistic conditions and a better experience to prepare the leadership and emergency personnel to contend with an actual event. Demonstrating the ways that IRS has flexible organizational assets that can be accessed during times of change, IRS strategically has made some operations redundant, which allows work to be shifted between offices when needed. The IRS has also exhibited the capability to use seasonal workers to increase its workforce after a disruption, as was the case in the support it provided to the Federal Emergency Management Agency after Hurricane Katrina. In building leadership and a committed workforce, the IRS has numerous formal training and development initiatives to build the leadership capability of both its management team as well as its non supervisory employees. While IRS employees understand how their work contributes to the IRS's goals and priorities, currently less than half of IRS employees believe that agency leaders and managers generate motivation and commitment in the workforce. A number of IRS initiatives are now in place to address this issue, including coaching of managers based on employee feedback survey data and outreach by managers to IRS employees. Lastly, IRS is highly networked both within and outside of IRS, which provides opportunities for accessing additional resources after a disruption. IRS has requirements for including internal stakeholders in tests and exercises. When IRS has involved external stakeholders in tests and exercises, it has proven useful, but this practice is neither formalized nor widespread.