Background

IRS administers America’s tax laws and collects the revenues that fund  government operations and public services. In fiscal year 2006, IRS  collected more than $2.5 trillion in revenue. IRS’s Taxpayer Service and  Enforcement programs generate more than 96 percent of the total federal  revenue collected for the U.S. government. Total federal revenues have  fluctuated from roughly 16 to 21 percent of gross domestic product  between 1962 and 2004. Given the amount of federal revenue collected by  IRS, a disruption of IRS operations could have great impact on the U.S.  economy.
The IRS headquarters building is located in Washington, D.C., and houses  over 2,200 of the agency’s estimated 104,000 employees. The headquarters  building contains the offices of IRS executive leaders, such as the  Commissioner and deputy commissioners, and headquarters personnel for  14 of the agency’s 17 individual business units.

		Flood of IRS’s Headquarters Building

On June 25, 2006, the IRS headquarters building suffered flooding during a  period of record rainfall and sustained extensive damage to its  infrastructure. The subbasement and basement were flooded, and critical  parts of the facility’s electrical and mechanical equipment were destroyed  or heavily damaged. The subbasement—which contained equipment such  as electrical transformers, electrical switchgears, and chillers—was  submerged in more than 20 feet of water. In addition, the basement level— which housed the building’s fitness center, food service canteens,  computer equipment, and the basement garage—was flooded with 5 feet  of water. As a result of the flood damage, the building was closed until  December 8, 2006. In response to the flood and the closure of the building,  IRS headquarters officials reported activating several of the agency’s  emergency operations plans. Over 2,000 employees normally assigned to  the headquarters building were relocated to other facilities throughout the  Washington, D.C., metropolitan area.
Although the flood severely damaged the building and necessitated the  relocation of IRS employees to alternate office space, particular  circumstances limited potential damage and made response and recovery  activities easier:    No employees were injured, killed, or missing as a result of the flood.    Damage was limited to the basement and subbasement levels, and  employees were able to enter the building to retrieve equipment and assets  5 days following the flood.  IRS and the General Services Administration were able to identify and  allocate alternate work space to accommodate all displaced employees,  not just those considered critical or essential.
According to IRS status reports following the flood, facility space was  provided for critical personnel within 10 days and for all headquarters  employees within 29 days. Table 1 provides a time line of activities  following the flood.
The Treasury Inspector General for Tax Administration also reviewed the  IRS response to the flooding. According to the Inspector General’s  reports, IRS adequately protected sensitive data and restored computer  operations to all employees approximately 1 month following the flood. In  addition, he reported that the flood caused no measurable impact on tax  administration because of the nature of the work performed at this  building and the contingency plans that IRS had in place. Finally, he  reported that IRS paid $4.2 million in salary costs for 101,000 hours of  administrative leave granted to IRS personnel following the flooding.  While $3 million was paid for administrative leave during the first week  following the flooding, the amount paid for administrative leave decreased  in subsequent weeks.

		IRS Headquarters Emergency Operations Plans

IRS headquarters has multiple emergency operations plans that if  activated, are intended to work in conjunction with each other during  emergencies. These plans include a suite of business continuity plans  comprised of, among others, a business resumption plan for each IRS  business unit and an Incident Management Plan. In addition, IRS has a  COOP plan for emergency events affecting IRS executive leadership and  essential functions. Table 2 summarizes the IRS emergency operations  plans and their purposes.

		Federal Guidance for Continuity Planning

FEMA developed FPC 65 to provide guidance to federal executive branch  departments and agencies in developing contingency plans and programs  to ensure the continuity of essential agency operations. All federal  executive branch agencies are required to have such a capability in place  to maintain essential government services across a wide range of all  hazard emergencies. This guidance defines the elements of a viable  continuity capability for agencies to address in developing their continuity  plans.
Table 3 summarizes eight general elements of federal continuity guidance  that agency plans should address.
IRS supplemented federal guidance with sections of its Internal Revenue  Manual—a document outlining the agency’s organization, policies, and  procedures—related to business resumption plans. Similar to the federal  continuity guidance, the Internal Revenue Manual outlined minimum  requirements for business resumption plans, including the need to identify  people and resources to perform critical functions.

	IRS Headquarters Emergency Operations Plans Partially Addressed Elements Outlined in Federal Guidance

The IRS headquarters emergency operations plans we reviewed  collectively addressed several of the general elements of guidance  identified in FPC 65. For example, the plans adequately identified the  people needed to continue performing essential functions and had  established procedures for activation. However, other elements were not  addressed or were addressed only in part. Specifically, IRS identified two  separate lists of essential functions—critical business processes and  essential functions for IRS leadership—within its plans but only prioritized  one of the lists. Furthermore, although the COOP plan outlined provisions  for tests, training, and exercises, neither the business resumption plans we  reviewed—from Criminal Investigation (CI), Wage and Investment (W&I),  and Chief Counsel—nor the Incident Management Plan outlined the need  to conduct such activities. While IRS’s Office of Physical Security and  Emergency Preparedness provided overall guidance to business units on  their business resumption plans, the guidance was inconsistent with the  federal guidance on several elements, including the preparation of  resources and facilities needed to support essential functions and  requirements for regular tests, training, and exercises. Until IRS requires  all of the plans that contribute to its ability to quickly resume essential  functions to fully address federal guidance, it will lack assurance that it is  adequately prepared to respond to the full range of potential disruptions.

		IRS Internal Guidance Did Not Fully Address Elements of a Viable Continuity Capability

Inconsistencies between IRS’s business resumption plans and federal  guidance can be attributed in part to gaps in IRS internal guidance. IRS  provided its business units with guidance on developing business  resumption plans, including general guidance within IRS’s Internal  Revenue Manual and a business resumption plan template disseminated to  the business units. The Internal Revenue Manual provided IRS business  units with minimum requirements of elements to include in their plans,  such as identifying critical personnel and resources. In addition, the Office  of Physical Security and Emergency Preparedness disseminated a business  resumption plan template to business units that included, among other  things, sections for identifying the critical business processes and  personnel to support the resumption of critical activities.
IRS’s internal guidance addressed several of the elements of a viable  continuity capability. For example, the Internal Revenue Manual stated  that business resumption plans should include a list of critical personnel,  and the business resumption plan template asked each business unit to list  its critical team leaders and members and their contact information.  Similarly, the IRS guidance adequately addressed execution and  resumption.
For other continuity planning elements, however, IRS guidance on  developing business resumption plans was inconsistent with federal  guidance. Specifically, IRS guidance on resources directed business units  to identify their need for vital records, systems, and equipment. However,  rather than procuring those resources before an event occurs, as outlined  in federal guidelines, IRS guidance assumed that business units will work  with teams outlined within the Incident Management Plan to acquire those  resources following a disruption. Similarly, IRS directed business units to  identify alternate work space requirements for personnel, but not to  prepare or acquire them until after a disruption occurs. Finally, IRS  guidance did not address the need for tests, training, or exercises involving  the critical personnel identified within business resumption plans.  Officials from the Office of Physical Security and Emergency  Preparedness stated that it was the responsibility of business units to  conduct adequate tests, training, and exercises of their business  resumption plans.
Officials further stated that the IRS response to the June 2006 flooding  validated the use of its incident command structure outlined in its Incident  Management Plan. Although the incident command structure can be  effective at securing needed resources over time, IRS will be able to  respond to a disruption more quickly if it prepares necessary resources  and facilities before an event occurs. This is especially critical in the case  of business processes that need to be restored within 24 to 36 hours.  Similarly, if personnel are unfamiliar with emergency procedures because  of inadequate training and exercises, the agency’s response to a disruption  could be delayed.

	IRS Emergency Plans Contributed to the Agency’s Flood Response

IRS officials largely relied upon the Incident Management Plan to direct  their response to the emergency conditions created by the June 2006  flooding. This plan guided officials in establishing roles and  responsibilities for command and control of the overall resumption effort  and a capability for the procurement of alternate facility space and  equipment. Business unit officials were initially guided by their business  resumption plans, but later response activities differed from those plans  because of the circumstances resulting from the event. According to IRS  headquarters officials, the headquarters COOP plan was not activated  because local space availability made moving the executive leadership to  the alternate COOP facility unnecessary and the safety of the leadership  was not at risk.

		The Incident Management Plan Contributed to Establishing a Command and Control Structure Immediately Following the Flood

We previously reported that in responding to emergencies, roles and  responsibilities for leadership must be clearly defined and effectively  communicated in order to facilitate rapid and effective decision making.  The IRS Incident Management Plan provided agency officials with clear  leadership roles and responsibilities for managing the response and  recovery process, including the procurement of temporary facility space  and equipment necessary to continue critical business processes.
Consistent with the plan, the Incident Commander acted as the leader of  IRS headquarters response and recovery activities immediately following  the flood. To assist in managing the incident, the Incident Commander  activated members of the IRS Incident Management Team and other  supporting sections, whose roles and responsibilities were outlined in the  plan. These individuals included business resumption team leaders from  each of the IRS business units and personnel from the central service  divisions, such as Real Estate and Facilities Management and  Modernization and Information Technology Services.
According to minutes from Incident Management Team meetings held in  the days following the flood, the following Incident Management  supporting teams were activated and provided the following contributions:  1.  The Operations Section, responsible for conducting response and  recovery activities, gathered information regarding the facility space  and equipment requests from the IRS business units, as well as  preferences on alternate work location assignments.  2.  The Logistics Section, responsible for providing all nonfinancial  logistical support, procured and allocated facility space and equipment  to IRS business units.  3.  The Planning Section, responsible for providing documentation of the  emergency, documented decisions and conducted reporting. For  example, the Planning Section prepared documents for hearings and  maintained relocation schedules and information.  4.  The Finance and Administrative Section, responsible for providing all  financial support, provided assistance in monitoring agency costs and  developing travel and leave policies.
According to IRS status reports following the flood, facility space was  provided for critical personnel within 10 days and for all headquarters  employees within 29 days. The Incident Commander reported that the  Incident Management Team and its supporting units stepped down  approximately 2 months after the flood.

		Business Resumption Plans Guided Initial Business Unit Flood Responses

The three business units we reviewed reported that their business  resumption plans guided their initial responses to the flood. In later phases  of their responses, the business units differed from their plans to account  for conditions at the time, such as current work priorities and the  availability of alternate office space for more staff than the minimum  necessary to perform the most critical functions. The following sections  outline how selected business units relied on their business resumption  plans when responding to the flood.

			Criminal Investigation

CI used its business resumption plan to (1) establish an internal command  structure to coordinate emergency activities following the flood and   (2) identify short-term facility space for selected employees. According to  the CI business resumption executive, the business unit used alternate  facilities previously identified within the CI business resumption plan to  relocate personnel within the first 2 days. CI leadership determined which  personnel would be placed first and at what locations, since its business  unit’s resumption plan did not specify such information. According to the  CI business resumption executive, after learning from the Incident  Commander that relocation would be for a longer period and that alternate  facility space was available to accommodate all displaced CI employees,  CI officials submitted a request for facility space and equipment for all of  their employees to the Incident Commander and Incident Management  Team.
In discussing lessons learned, the CI business resumption executive  acknowledged that the unit’s plan primarily addressed relocation to  alternate facilities for short-term emergencies rather than longer-term  events like the flood, and that CI should work with IRS’s central  organizations to better plan for relocation in such situations. Furthermore,  the executive stated that better tests and exercises of the CI plan could  assist in better preparing for a wider range of future emergencies.

			Wage and Investment

W&I officials used their plan to identify and prioritize critical tasks. W&I  managers gathered at a previously scheduled off-site retreat the morning  following the flood and conducted a review of the business unit’s  resumption plan, according to the new W&I business resumption  executive. The executive stated that the activity was particularly useful in  addressing identified knowledge gaps in the wake of the prior W&I  business resumption leader’s sudden death the day before the flood.  Critical business processes and supporting tasks, initially prioritized  within the plan, were adjusted to reflect the criticality of several tasks at  that time of year. According to the business resumption executive, the  revised list of critical business processes allowed W&I managers to  identify critical personnel and resources, which were submitted to the  Incident Management Team as facility space and resource requests. In  addition, the executive stated that W&I managers established a system for  placing employees in alternate work space based on their association with  the prioritized tasks, although it was not reflected in the W&I business  resumption plan.
W&I created a document to capture lessons learned following the flood  and established an internal business resumption working group to ensure  a business resumption capability in all W&I field offices. As W&I officials  did not anticipate the need to readjust tasks, one item discussed in the  document addressed the need to create a rolling list of critical business  processes and critical personnel, as processes and tasks will vary  throughout the year. In addition, the W&I business resumption working  group developed minimum requirements for all W&I plans and conducted  a gap analysis of field office plans to identify areas for improvement.  According to the W&I business resumption executive, the working group  will conduct a training session for field office business resumption  coordinators after the 2007 filing season.

			Chief Counsel

Although the Chief Counsel resumption efforts were led by people  identified within its plan, the unit’s business resumption officials reported  that use of the plan was limited because of the high-level content of the  document. According to the Chief Counsel’s business resumption  executive, the plan was written at a high level because it was expected  that specific priorities would be determined by the active caseload at the  time of the emergency. The executive stated that following the flood, Chief  Counsel prioritized resumption activities based on the active caseload and  the need to address emerging requirements, such as (1) ensuring that mail  addressed to the business unit’s processing division was rerouted and  processed at another facility and (2) supporting a specific court case being  conducted in New York City because of its level of criticality and time  sensitivity. The executive further stated that officials identified alternate  work space in Chief Counsel offices in the Washington, D.C., metropolitan  area and placed approximately 180 employees prioritized based on the  organizational hierarchy. Chief Counsel submitted requests to the Incident  Commander and Incident Management Team for facility space and  resources for over 500 remaining employees.
Although Chief Counsel was able to identify tasks, such as tax litigation,  that were consistent with responsibilities outlined in its plan and procured  facility space and resources for personnel, it established a task force that  identified recommendations to improve the business unit’s plan in a report  documenting lessons learned following the flood. Recommendations  included measures to improve the prioritization of critical functions and  people and outline provisions for mail processing. In addition, because  Chief Counsel experienced delays in recovering a computer server that  had not been identified in the business resumption plan but proved to be  important following the flood, the task force addressed the need to ensure  redundancy of information technology equipment. Chief Counsel is  currently drafting an action plan to carry out the recommendations of the  task force. In addition, a Chief Counsel business resumption official stated  that agencywide tests and exercises of business resumption plans could  assist in better integration of emergency efforts for a wider range of future  emergencies.

		IRS Headquarters Continuity of Operations Plan Was Not Used in Flood Response

According to IRS headquarters officials, the headquarters COOP plan was  not activated because local space availability made movement of  executive leadership to the alternate COOP facility unnecessary and the  safety of the leadership was not at risk.

	Conclusions

When the June 2006 flood occurred at the IRS headquarters building, the  agency had in place a suite of emergency plans that helped guide its  response. The agency’s Incident Management Plan was particularly useful  in establishing clear lines of authority and communications, conditions  that we have previously reported to be critical to an effective emergency  response. Unit-level business resumption plans we reviewed contributed  to a lesser extent and the headquarters COOP plan was not activated  because of conditions particular to the 2006 flood. Specifically, damage to  the building was limited to the basement and subbasement levels, and  employees were able to enter the building to retrieve equipment and  assets. In addition, alternate work space was available for all employees  within a relatively short period, reducing the importance of identifying  critical personnel. Such conditions, however, may not be present during  future disruptions.
The plans IRS had in place at the time of the flood did not address all of  the elements outlined in federal continuity guidance. In particular, the IRS  plans did not (1) prioritize all essential functions and set targets for  recovery times; (2) outline the preparation of resources and alternate  facilities necessary to perform those functions; and (3) develop provisions  for tests, training, and exercises of all of its plans. In discussions on  lessons learned from the flood response, IRS business unit officials  recognized the need to incorporate many of these elements. Unless IRS  addresses these gaps, it will have limited assurance that it will be prepared  to continue essential functions following a disruption more severe than  the 2006 flood.

	Recommendations for Executive Action

To strengthen the ability of IRS to respond to the full range of potential  disruptions to essential operations, we are making two recommendations  to the Commissioner of Internal Revenue:    Revise IRS internal emergency planning guidance to fully reflect federal  guidance on the elements of a viable continuity capability, including the  identification and prioritization of essential functions; the preparation of  necessary resources and alternate facilities; and the regular completion of  tests, training, and exercises of continuity capabilities.
Revise IRS emergency plans in accordance with the new internal  guidance.

	Agency Comments

The Commissioner of Internal Revenue provided comments on a draft of  this report in a March 26, 2007, letter which is reprinted in appendix II. The  Commissioner agreed with our recommendations. His letter notes that the  agency is actively committed to improving its processes. Specifically the  agency will (1) conduct a thorough gap analysis between FPC 65 elements  and business continuity planning guidance; (2) update the Internal  Revenue Manual guidance and business resumption plan templates to  reflect areas of improvement resulting from the gap analysis; and   (3) formally direct annual tests, training, and exercises of business  resumption plans through the agency’s Emergency Management and  Preparedness Steering Committee. Finally, the Commissioner stated that  the agency will revise and implement its emergency plans based on the  results of the aforementioned activities.
As agreed with your staff, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days after its  date. At that time, we will send copies of this report to the Secretary of the  Treasury, the Commissioner of Internal Revenue, and other interested  parties. This report will also be available at no charge on the GAO Web site  at http://www.gao.gov.
Should you or your staff have questions on matters discussed in this  report, please contact Bernice Steinhardt at (202) 512-6543 or  steinhardtb@gao.gov, or Linda Koontz at (202) 512-6240 or  koontzl@gao.gov. Contact points for our Offices of Congressional  Relations and Public Affairs may be found on the last page of this report.  Key contributions to this report were made by William Doherty, Assistant  Director; James R. Sweetman, Jr., Assistant Director; Thomas Beall;  Michaela Brown; Terrell Dorn; Nick Marinos; and Nhi Nguyen.

Appendix I: Objectives, Scope, and Methodology

The objectives of this report were to    evaluate how the Internal Revenue Service’s (IRS) emergency operations  plans address federal guidance related to continuity planning and    evaluate the extent to which IRS emergency operations plans contributed  to the actions taken by IRS officials in response to the flood.
To address how IRS emergency operations plans address federal guidance  related to continuity planning, we obtained the IRS headquarters  emergency operations plans that were available to agency officials at the  time of the June 2006 flood. These included the Continuity of Operations  (COOP) plan and a suite of business continuity plans, including the  Incident Management Plan and 13 business resumption plans from  business units affected by the flood. Although we also obtained the  headquarters Occupant Emergency Plan, we did not evaluate its  contributions to addressing the elements because its purpose is limited to  outlining procedures for building occupants and emergency personnel in  responding to threats that require building evacuations or shelter in place.  We did not obtain the Disaster Recovery Plan, a contingency plan for the  recovery of information technology equipment, because recovery of  information technology equipment was addressed in a report from the  Treasury Inspector General for Tax Administration.
To evaluate IRS’s emergency operations plans in relation to federal  guidance on continuity planning, we analyzed Federal Preparedness  Circular (FPC) 65 to identify the elements needed to ensure the continuity  of essential functions and compared IRS emergency operations plans to  the resulting generalized list. Because FPC 65 covers all hazard  emergencies, but provides continuity guidance specifically for agency  COOP plans, we developed the general elements of guidance to be able to  collectively evaluate all IRS emergency operations plans we obtained.  From our analysis of FPC 65, we identified eight general elements of  guidance related to developing a viable continuity capability. See table 3  for a listing and description of the elements. We reviewed IRS’s plans and  analyzed how they collectively addressed or did not address these eight  general elements of guidance.
We also reviewed IRS-defined criteria and guidance for emergency  operations plans, including sections of the Internal Revenue Manual— which provides guidance to IRS officials on developing several of the  agency’s emergency operations plans—and an internal template provided  by IRS’s Office of Physical Security and Emergency Preparedness, which  is responsible for agencywide emergency planning and policy to guide  plan development.
Since each business unit within IRS headquarters has an individual plan  for business resumption activities, we selected and examined 3 of 13  business resumption plans available for use during the flood from the 3  business units with the most employees affected by the flooding in the  headquarters building. According to employee relocation lists from IRS  following the flood, the 3 largest business units in the building are  Criminal Investigation, Wage and Investment, and Chief Counsel, which  collectively represent over 50 percent of the headquarters building  employees.
To address the extent to which IRS emergency operations plans  contributed to the actions taken by IRS officials in response to the flood,  we interviewed IRS officials responsible for the development, oversight,  and implementation of the headquarters emergency operations plans. In  our interviews, we asked IRS officials responsible for each emergency  operations plan how the general elements identified in their respective  plans guided their actions following the flood, if at all.
To supplement the information gained from the interviews, we reviewed  agency documentation related to emergency operations activities  following the flood, including IRS status reports, employee relocation lists,  and emergency operations team meeting minutes. In addition, we  reviewed documentation regarding lessons learned from the flood,  provided by various headquarters business units, and obtained any  updates or changes to emergency operations plans following the flood.
We conducted our review in accordance with generally accepted  government auditing standards from July 2006 through March 2007.

Appendix II: Comments from the Internal Revenue Service

Summary:
Why GAO Did This Study

On June 25, 2006, the Internal Revenue Service (IRS) headquarters building suffered flooding during a period of record rainfall and sustained extensive damage to its infrastructure. IRS officials ordered the closure of the building until December 2006 to allow for repairs to be completed. IRS headquarters officials reported activating several of the agency's emergency operations plans. Within 1 month of the flood, over 2,000 employees normally assigned to the headquarters building were relocated to other facilities throughout the Washington, D.C., metropolitan area. GAO was asked to report on (1) how IRS emergency operations plans address federal guidance related to continuity planning and (2) the extent to which IRS emergency operations plans contributed to the actions taken by IRS officials in response to the flood. To address these objectives, GAO analyzed federal continuity guidance, reviewed IRS emergency plans, and interviewed IRS officials.

What GAO Found

The IRS headquarters emergency operations plans that GAO reviewed--the headquarters Continuity of Operations (COOP) plan, Incident Management Plan, and three selected business resumption plans--collectively addressed several of the general elements identified within federal continuity guidance for all executive branch departments and agencies. For example, the plans adequately identified the people needed to continue performing essential functions. However, other elements were not addressed or were addressed only in part. Specifically, IRS had two separate lists of essential functions--critical business processes and essential functions for IRS leadership--within its plans, but prioritized only one of the lists. Furthermore, although the COOP plan outlined provisions for tests, training, and exercises, none of the other plans GAO reviewed outlined the need to conduct such activities. While IRS provided overall guidance to its business units on their business resumption plans, the guidance was inconsistent with the federal guidance on several elements, including the preparation of resources and facilities needed to support essential functions and requirements for regular tests, training, and exercises. The IRS Incident Management Plan was particularly useful in establishing clear lines of authority and communications in response to the flooding. Unit-level business resumption plans GAO reviewed contributed to a lesser extent, and the headquarters COOP plan was not activated because of conditions particular to the 2006 flood. Specifically, damage to the building was limited to the basement and subbasement levels, and employees were able to enter the building to retrieve equipment and assets. In addition, alternate work space was available for all employees within a relatively short period, reducing the importance of identifying critical personnel. While its plans helped guide IRS's response to the conditions that resulted from the flood, in more severe emergency events, conditions could be less favorable to recovery. Consequently, unless IRS fills in gaps in its guidance and plans, it lacks assurance that the agency is adequately prepared to respond to the full range of potential disruptions.