Background

Federal operations and facilities have been disrupted by a range of events,  including the terrorist attacks on September 11, 2001; the Oklahoma City  bombing; localized shutdowns due to severe weather conditions, such as  the closure of federal offices in Denver for 3 days in March 2003 due to  snow; and building-level events, such as asbestos contamination at the  Department of the Interior’s headquarters. Such disruptions, particularly if  prolonged, can lead to interruptions in essential government services.  Prudent management, therefore, requires that federal agencies develop  plans for dealing with emergency situations, including maintaining  services, ensuring proper authority for government actions, and protecting  vital assets.
Until relatively recently, continuity planning was generally the  responsibility of individual agencies. In October 1998, PDD 67 identified  FEMA—which is responsible for responding to, planning for, recovering  from, and mitigating against disasters—as the executive agent for federal  COOP planning across the federal executive branch. FEMA was an  independent agency until March 2003, when it became part of the  Department of Homeland Security, reporting to the Under Secretary for  Emergency Preparedness and Response.
PDD 67 is a Top Secret document controlled by the National Security  Council. FPC 65 states that PDD 67 made FEMA, as executive agent for  COOP, responsible for   formulating guidance for agencies to use in developing viable plans;  coordinating interagency exercises and facilitating interagency  coordination, as appropriate; and  overseeing and assessing the status of COOP capabilities across the  executive branch.
According to FEMA officials, PDD 67 also required that agencies have  COOP plans in place by October 1999.
In July 1999, FEMA issued FPC 65 to assist agencies in meeting the October  1999 deadline. FPC 65 states that COOP planning should address any  emergency or situation that could disrupt normal operations, including  localized emergencies. FPC 65 also determined that COOP planning is  based first on the identification of essential functions—that is, those  functions that enable agencies to provide vital services, exercise civil  authority, maintain safety, and sustain the economy during an emergency.  FPC 65 gives no criteria for identifying essential functions beyond this  definition.
Although FPC 65 gives no specific criteria for identifying essential  functions, a logical starting point for this process would be to consider  programs that had been previously identified as important. For example, in March 1999, as part of the efforts to address the Y2K computer problem,  the Director of OMB identified 42 programs with a high impact on the  public:   Of these 42 programs, 38 were the responsibility of the 23 major  departments and agencies that we reviewed. (App. III provides a list of  these 38 high-impact programs and the component agencies that are  responsible for them.)
Of these 23 major departments and agencies, 16 were responsible for at  least one high-impact program; several were responsible for more than  one.
Programs that were identified included weather service, disease  monitoring and warnings, public housing, air traffic control, food stamps,  and Social Security benefits. These programs, as well as the others listed in  appendix III, continue to perform important functions for the public.
The Y2K planning to support these high-impact programs included COOP  planning and specifically addressed interdependencies. Planning included  identifying partners integral to program delivery, testing data exchanges  across partners, developing complementary business continuity and  contingency plans, sharing key information on readiness with other  partners and the public, and taking other steps to ensure that the agency’s  high-impact program would work in the event of an emergency.
Although the identification of essential functions was established as the  first step in COOP planning, FPC 65 also identified an additional seven  other planning topics that make up a viable COOP capability. The guidance  provided a general definition of each of the eight topics and identified  several actions that should be completed to address each topic. Table 1  lists the eight topic areas covered in FPC 65 and provides an example of an  action under each.

	Many COOP Plans Did Not Address Previously Identified Essential Functions or Interdependencies with Other Entities

The identification of essential functions is a prerequisite for COOP  planning because it establishes the planning parameters that drive the  agency’s efforts in all other planning topics. For example, FPC 65 directs  agencies to identify alternative facilities, staff, and resources necessary to  support continuation of their essential functions. The effectiveness of the  plan as a whole and the implementation of all other elements depend on the  performance of this step.
Of the 34 agency COOP plans we reviewed, 29 plans included at least one  function that was identified as essential. These agency-identified essential  functions varied in number and scope. The number of functions identified  in each plan ranged from 3 to 399. In addition, the apparent importance of  the functions was not consistent. For example, a number of essential  functions were of clear importance, such as   “ensuring uninterrupted command, control, and leadership of the   “protecting critical facilities, systems, equipment and records”; and  “continuing to pay the government’s obligations.”
Other identified functions appeared vague or of questionable importance:   “provide speeches and articles for the Secretary and Deputy Secretary”;  “schedule all activities of the Secretary”; and   “review fiscal and programmatic integrity and efficiency of  Departmental activities.”
In contrast to the examples just given, agencies did not list among their  essential functions 20 of the 38 “high-impact” programs identified during  the Y2K effort at the agencies we reviewed.
Another important consideration in identifying essential functions is the  assessment of interdependencies among functions and organizations. As  we have previously reported, many agency functions rely on the  availability of resources or functions controlled by another organization,  including other agencies, state and local governments, and private entities.  (For example, the Department of the Treasury’s Financial Management  Service receives and makes payments for most federal agencies.) The  identification of such interdependencies continues to be essential to the  related areas of information security and critical infrastructure protection.  Although FPC 65 does not use the term “interdependencies,” it directs  agencies to “integrate supporting activities to ensure that essential  functions can be performed.”
Of the 34 plans we reviewed, 19 showed no evidence of an effort to identify  interdependencies and link them to essential functions, which is a  prerequisite to developing plans and procedures to support these functions  and all other elements of COOP planning. Nine plans identified some key  partners, but appeared to have excluded others: for instance, six agencies  either make or collect payments, but did not mention the role of the  Treasury Department in their COOP plans.
The high level of generality in FEMA’s guidance on essential functions  contributed to the inconsistencies in agencies’ identification of these  functions. In its initial guidance, FPC 65, FEMA provided minimal criteria  for agencies to make these identifications, giving a brief definition only.  According to FEMA officials, the agency is currently developing revised  COOP guidance that will provide more specific direction on identifying  essential functions. According to these officials, FEMA expects to release  the revised guidance in March 2004.
Further, although FEMA conducted several assessments of agency COOP  planning between 1995 and 2001, none of these addressed the identification  of essential functions. In addition, FEMA has begun development of a  system to collect data from agencies on the readiness of their COOP plans,  but FEMA officials told us that they will not use the system to validate the  essential functions identified by each agency or their interdependencies.  According to FEMA officials, the agencies are better able to make those  determinations. However, especially in view of the wide variance in  number and importance of functions identified, as well as omissions of  high-impact programs, the lack of FEMA review lowers the level of  assurance that the essential functions that have been identified are  appropriate.
Additionally, in its oversight role, FEMA had the opportunity to help  agencies refine their essential functions through an interagency COOP test  or exercise. According to FPC 65, FEMA is responsible for coordinating  such exercises. FEMA is developing a test and training program for COOP  activities, but it has not yet conducted an interagency exercise to test the  feasibility of these planned activities. FEMA had planned a  governmentwide exercise in 2002, but the exercise was cancelled after the  September 11 attacks. FEMA is currently preparing to conduct a  governmentwide exercise in mid-May 2004.
Improper identification of essential functions can have a negative impact  on the entire COOP plan, because other aspects of the COOP plan are  designed around supporting these functions. If an agency fails to identify a  function as essential, it will not make the necessary arrangements to  perform that function. If it identifies too many functions as essential, it  risks being unable to adequately address all of them. In either case, the  agency increases the risk that it will not be able to perform its essential  functions in an emergency.

	Agency COOP Plans Addressed Some, but Not All, of FEMA’s Guidance

As of October 1, 2002, almost 3 years after the planning deadline  established by PDD 67, 3 of the agencies we reviewed had not developed  and documented a COOP plan. The remaining 20 major federal civilian  agencies had COOP plans in place, and the 15 components that we  reviewed also had plans. (App. IV identifies the 15 components and the  high-impact programs for which they are responsible.) However, none of  these plans addressed all the guidance in FPC 65. Of the eight topic areas  identified in FPC 65, these 34 COOP plans generally complied with the  guidance in one area (developing plans and procedures); generally did not  comply in one area (tests, training, and exercises); and showed mixed  compliance in the other six areas.
The following sections present the results of our analysis for each of the  eight planning topics outlined in FPC 65. In analyzing each plan, we looked  for the answers to a series of questions regarding each planning topic. We  present the compiled results for each topic in the form of a table showing  the answers to these questions. Appendix I provides more detail on our  analysis and methods.

		Essential Functions

Although most agency plans identified at least one essential function, less  than half the COOP plans fully addressed other FPC 65 guidance related to  essential functions, such as prioritizing the functions or identifying  interdependencies among them (see table 2). If agencies do not prioritize  their essential functions and identify the resources that are necessary to  accomplish them, their COOP plans will not be effective, since the other  seven topics of the COOP plan are designed around supporting these  functions.

		Plans and Procedures

FPC 65 calls for COOP plans to be developed and documented that provide  for the performance of essential functions under all circumstances. Most  agency COOP documents included the basic information outlined in FPC  65 (see table 3). However, in those cases where plans and procedures are  not adequately documented, agency personnel may not know what to do in  an emergency.

		Order of Succession

Orders of succession ensure continuity by identifying individuals who are  authorized to act for agency officials in case those officials are unavailable.  Although most agency COOP documents adequately described the order of  succession to the agency head and described orders of succession by  position or title, fewer addressed other succession planning procedures  outlined in FPC 65 (see table 4). If orders of succession are not clearly  established, agency personnel may not know who has authority and  responsibility if agency leadership is incapacitated in an emergency.

		Delegations of Authority

To provide for rapid response to emergencies, FPC 65 calls for agencies to  delegate authorities in advance for making policy determinations at all  levels. Generally, these delegations define what actions those individuals  identified in the orders of succession can take in emergencies. Few agency  COOP documents adequately described the agency’s delegations of  authority (see table 5). If delegations of authority are not clearly  established, agency personnel may not know who has authority to make  key decisions in an emergency.

		Alternate Facilities

Alternate facilities provide a physical location from which to conduct  essential functions if the agency’s existing facilities are unavailable. Most  agency COOP plans document the acquisition of at least one alternate  facility for use in emergencies, but few of those plans demonstrate that the  facilities are capable of meeting the agencies’ emergency operating  requirements (see table 6). If alternate facilities are not provided or are  inadequate, agency operations may not be able to continue in an  emergency.

		Redundant Emergency Communications

The success of agency operations at an alternate facility depends on  available and redundant communications with internal organizations, other  agencies, critical customers, and the public. Most COOP documents  identified some redundant emergency communications capabilities, but  few included contact information that would be necessary to use those  capabilities in an emergency (see table 7). If communications fail in an  emergency, essential agency operations may not be possible.

		Vital Records

FPC 65 states that agency personnel must have access to and be able to use  the electronic and hard-copy records and information systems that are  needed to perform their essential functions. About 24 percent of the COOP  plans fully identified agencies’ vital paper and electronic records, while  fewer documented the procedures for protecting or updating them (see  table 8). If agency personnel cannot access and use up-to-date vital records,  they may be unable to carry out essential functions.

		Tests, Training, and Exercises

Tests, training, and exercises of COOP capabilities are essential to  demonstrate and improve agencies’ abilities to execute their plans. Few  agencies have documented that they have conducted tests, training, and  exercises at the recommended frequency (see table 9). If emergency  procedures are not tested and staff is not trained in their use, planned  responses to an emergency may not be adequate to continue essential  functions.

		Limitations in FEMA’s Oversight Contribute to Noncompliance

The lack of compliance shown by many COOP plans can be largely  attributed to FEMA’s limited guidance and oversight of executive branch  COOP planning. First, FEMA has issued little guidance to assist agencies in  developing plans that address the goals of FPC 65. Following FPC 65,  FEMA issued more detailed guidance in April 2001 on two of FPC 65’s eight  topic areas: FPC 66 provides guidance on developing viable test, training,  and exercise programs, and FPC 67 provides guidance for acquiring  alternate facilities. However, FEMA did not produce any detailed guidance  on the other six topic areas.
In October 2003, FEMA began working with several members of the  interagency COOP working group to revise FPC 65. FEMA officials expect  this revised guidance, which was still under development as of January  2004, to incorporate the guidance from the previous FPCs and to address  more specifically what agencies need to do to comply with the guidance.
Second, as part of FEMA’s oversight responsibilities, its Office of National  Security Coordination is tasked with conducting comprehensive  assessments of the federal executive branch COOP programs. With the  assistance of contractors, the office has performed assessments, on an  irregular schedule, of federal agencies’ emergency planning capabilities:  In 1995, FEMA performed a survey of agency officials (this assessment  predated FPC 65).
In 1999, FEMA assessed compliance with the elements of FPC 65  through a self-reported survey of agency COOP officials, supplemented  by interviews.
In 2001, FEMA surveyed agency officials to ask, among other things,  about actions that agencies took on and immediately after September  11, 2001.
Of these three assessments, only the 1999 assessment evaluated  compliance with the elements of FPC 65. Following this assessment, FEMA  gave agencies feedback on ways to improve their respective COOP plans,  and it made general recommendations, not specific to individual agencies,  that addressed programwide problems. However, FEMA did not then  follow up to determine whether individual agencies made improvements in  response to its feedback and general recommendations. Besides inquiring  about actions in response to the September 2001 attacks, the 2001  assessment was designed to provide an update on programwide problems  that had been identified in the assessments of 1995 and 1999. It did not  address whether individual agency COOP plans had been revised to correct  previously identified deficiencies, nor did FEMA provide specific feedback  to individual agencies.
According to FEMA officials, the system it is developing to collect agency- reported data on COOP plan readiness will improve FEMA’s oversight. The  system is based on a database of information provided by agencies for the  purpose of determining if they are prepared to exercise their COOP plans,  in part by assessing compliance with FPC 65. However, according to FEMA  officials, while they recognize the need for some type of verification, FEMA  has not yet determined a method of verifying these data.
Without regular assessments of COOP plans that evaluate individual plans  for adequacy, FEMA will not be able to provide information to help  agencies improve their COOP plans. Further, if FEMA does not verify the  data provided by the agencies or follow up to determine whether agencies  have improved their plans in response to such assessments, it will have no  assurance that agencies’ emergency procedures are appropriate.
FEMA officials attributed the limited level of oversight that we found to  two factors. First, they stated that before its transition to the Department of  Homeland Security, the agency did not have the legal or budgetary  authority to conduct more active oversight of the COOP activities of other  agencies. However, FPC 65 states that PDD 67 made the agency responsible  for guidance, coordination, and oversight in this area, in addition to  requiring agencies to develop COOP plans. Accordingly, although it cannot  determine how agencies budget resources for such planning, it does have  the authority to oversee this planning. Second, according to these officials,  until last year, the agency devoted roughly 13 staff to COOP guidance,  coordination, and oversight, as well as the development of FEMA’s own  COOP plan. According to the official responsible for COOP oversight, the  agency now has 42 positions authorized for COOP activities, 31 of which  were filled as of December 31, 2003. The agency expects to fill another 4  positions in fiscal year 2004.

	Conclusions

While most of the federal agencies we reviewed had developed COOP  plans, three agencies did not have documented plans as of October 2002.  Those plans that were in place exhibited weaknesses in the form of widely  varying determinations about what functions are essential and inconsistent  compliance with guidance that defines a viable COOP capability. The  weaknesses that we identified could cause the agencies to experience  difficulties in delivering key services to citizens in the aftermath of an  emergency.
A significant factor contributing to this condition is FEMA’s limited efforts  to fulfill its responsibilities first by providing guidance to help agencies  develop effective plans and then by assessing those plans. Further, FEMA  has done very little to help agencies identify those functions that are truly  essential or to identify and plan for interdependencies among agency  functions. FEMA has begun taking steps to improve its oversight, by  developing more specific guidance and a system to track agency-provided  COOP readiness information, and it is planning a governmentwide  exercise. However, although the proposed guidance and exercise may help  agencies improve their plans, the system that FEMA is developing to  collect data on COOP readiness is weakened by a lack of planning to verify  agency-submitted data, validate agency-identified essential functions, or  identify interdependencies with other activities. Without this level of active  oversight, continuity planning efforts will continue to fall short and  increase the risk that the public will not be able to rely upon the continued  delivery of essential government programs and services following an  emergency.

	Recommendations for Executive Action

We are making three recommendations to enhance the ability of the  executive branch to continue to provide essential services during  emergencies.
To ensure that agencies can continue operations in emergencies and are  prepared for the governmentwide exercise planned for May 2004, we  recommend that the Secretary of Homeland Security direct the Under  Secretary for Emergency Preparedness and Response to take steps to  ensure that agencies that do not have COOP plans develop them by May  1, 2004.
We further recommend that the Secretary direct the Under Secretary to  take steps to improve the oversight of COOP planning by   ensuring that agencies correct the deficiencies in individual COOP plans  identified here, as well as those identified in previous assessments, and  conducting assessments of agency continuity plans that include  independent verification of agency-provided information, as well as an  assessment of the essential functions identified and their  interdependencies with other activities.

	Agency Comments

In written comments on a draft of this report, which are reprinted in  appendix V, the Under Secretary for Emergency Preparedness and  Response agreed that better COOP planning is needed to ensure delivery of  essential services, and that FEMA could do more to improve COOP  planning. He added that the agency has begun to correct the identified  deficiencies and stated that the federal government is currently poised to  provide services in an emergency. The Under Secretary’s commitment to  improve FEMA’s oversight of COOP planning can be instrumental in  ensuring that agencies prepare adequate plans. Specifically, once FEMA  ensures that each agency has a COOP plan, ensures that agencies correct  the identified deficiencies in existing plans, and conducts independent  verification and assessments of those plans, it will be in a position to  effectively demonstrate the readiness of federal agencies to respond to  emergencies.
As agreed with your office, unless you publicly announce its contents  earlier, we plan no further distribution of this report until 30 days from the  date of this report. At that time, we will send copies to the Chairmen and  Ranking Minority Members of the Subcommittee on Homeland Security,  House Committee on Appropriations; Subcommittee on National Security,  Emerging Threats, and International Relations, House Committee on  Government Reform; and the Subcommittee on Oversight of Government  Management, the Federal Workforce, and the District of Columbia, Senate  Committee on Governmental Affairs. We are also sending copies to the  Secretary of Homeland Security. We will also make copies available on  request. In addition, the report will be available at no charge on the GAO  Web site at http://www.gao.gov.
Should you have any questions on matters contained in this report, please  contact me at (202) 512-6240 or by e-mail at koontzl@gao.gov. Other key  contributors to this report were Barbara Collier, Mirko Dolak, Neela  Lakhmani, Susan Sato, James R. Sweetman, Jr., Jessie Thomas, and Marcia  Washington.

Scope and Methodology

To accomplish our objectives, we obtained and evaluated headquarters  contingency plans that were in place as of October 1, 2002, from 20 of the  23 largest civilian departments and agencies (listed in app. II). We also  obtained and evaluated 14 plans covering 15 components of civilian  cabinet-level departments, selected because these components were  responsible for a program previously deemed high impact by the Office of  Management and Budget (OMB). (App. III lists these components and the  high-impact programs.) We also interviewed agency officials who were  responsible for developing each of the 34 continuity of operations (COOP)  plans (comprising the 20 plans for the largest civilian departments and  agencies and the 14 plans covering components with high-impact  programs); obtained and analyzed COOP guidance issued by the Federal  Emergency Management Agency (FEMA) and documents describing its  efforts to provide oversight and assessments of federal COOP planning  efforts; and conducted interviews with FEMA officials to clarify the  activities described in these documents.
To assess the adequacy of agency-identified essential functions, we  analyzed the COOP plans from agencies that were responsible for  programs that OMB designated as having high impact to determine whether  the plans described how those programs would continue to function during  an emergency, and we assessed COOP documentation for evidence of  agency efforts to identify interdependencies between their essential  functions and functions or resources controlled by others. For example, for  those agencies responsible for processing incoming or outgoing payments,  we looked for evidence that the agency had identified services provided by  the Department of the Treasury as necessary to the continuation of its  functions.
To assess how well agency plans followed Federal Preparedness Circular  (FPC) 65, we analyzed the guidance and identified 34 yes/no questions,  grouped by the eight topic areas identified in FPC 65. Each topic area  included two to eight questions. On the basis of the agency contingency  planning documents, we used content analysis to assign an answer of “yes”  (compliant), “no” (not compliant), or “partially” to these 34 questions.
Documents were reviewed and compared independently by several of our  analysts. The analysts then met to compare their assessments and reach a  consensus assessment. We shared these initial assessments with each  agency during structured interviews, giving agency officials the  opportunity to provide additional documentation to demonstrate  compliance. Any supplemental information provided by the agencies was  again reviewed by multiple analysts, first independently and then jointly.
From this analysis, we created the summary tables that appear in this  report (tables 2 to 9) to compare answers across agencies.
We requested that the National Security Council provide a copy of  Presidential Decision Directive (PDD) 67, which lays out the policy  guidance for executive branch contingency planning and describes the  authority granted to FEMA and other agencies. To date, we have not  received a copy. Instead, we relied on the characterization of PDD 67 in  FPC 65 and on statements from FEMA officials on the requirements within  PDD 67. Without a copy of PDD 67, we were unable to verify the  responsibilities or scope of authority of the various executive branch  entities responsible for contingency planning.
We conducted our review between April 2002 and January 2004, in  accordance with generally accepted government auditing standards.

Major Civilian Departments and Agencies Selected for Review

Thirty-eight High-Impact Programs and Responsible Agencies

Component Agencies Reviewed, with High- Impact Program Responsibilities

Comments from the Federal Emergency Management Agency

	GAO’s Mission

The General Accounting Office, the audit, evaluation and investigative arm of  Congress, exists to support Congress in meeting its constitutional  responsibilities and to help improve the performance and accountability of the  federal government for the American people. GAO examines the use of public  funds; evaluates federal programs and policies; and provides analyses,  recommendations, and other assistance to help Congress make informed  oversight, policy, and funding decisions. GAO’s commitment to good  government is reflected in its core values of accountability, integrity, and  reliability.

	Obtaining Copies of GAO Reports and Testimony

The fastest and easiest way to obtain copies of GAO documents at no cost is  through the Internet. GAO’s Web site (www.gao.gov) contains abstracts and full- text files of current reports and testimony and an expanding archive of older  products. The Web site features a search engine to help you locate documents  using key words and phrases. You can print these documents in their entirety,  including charts and other graphics.
Each day, GAO issues a list of newly released reports, testimony, and  correspondence. GAO posts this list, known as “Today’s Reports,” on its Web  site daily. The list contains links to the full-text document files. To have GAO e- mail this list to you every afternoon, go to www.gao.gov and select “Subscribe to  e-mail alerts” under the “Order GAO Products” heading.

		Order by Mail or Phone

	To Report Fraud, Waste, and Abuse in Federal Programs

	Public Affairs

Summary:
Why GAO Did This Study

To ensure that essential government services are available in emergencies--such as terrorist attacks, severe weather, or building-level emergencies-- federal agencies are required to develop continuity of operations (COOP) plans. Responsibility for formulating guidance on these plans and for assessing executive branch COOP capabilities lies with the Federal Emergency Management Agency (FEMA), under the Department of Homeland Security. FEMA guidance, Federal Preparedness Circular (FPC) 65 (July 1999), provides elements of a viable COOP capability, including the requirement that agencies identify their essential functions. GAO was asked to determine the extent to which (1) major civilian executive branch agencies have identified their essential functions and (2) these agencies' COOP plans follow FEMA guidance.

What GAO Found

From an assessment of 34 COOP plans against FEMA guidance, GAO found that most agencies' plans identified at least one function as essential. However, the functions identified in each plan varied widely in number-- ranging from 3 to 399--and included functions that appeared to be of secondary importance, while at the same time omitting programs that had been previously defined as high-impact programs. (Examples of these highimpact programs are Medicare, food stamps, and border inspections.) For example, one department included "provide speeches and articles for the Secretary and Deputy Secretary," among its essential functions, but did not include 9 of 10 high-impact programs for which it is responsible. Several factors contributed to these shortcomings: FPC 65 did not provide specific criteria for identifying essential functions; FEMA did not review the essential functions identified when it assessed COOP planning; and it did not conduct tests or exercises to confirm that the essential functions were correctly identified. Unless agencies' essential functions are correctly and completely identified, their COOP plans may not effectively ensure that the most vital government services can be maintained in an emergency. Although all but three of the agencies reviewed had developed and documented some of the elements of a viable COOP plan, none of the agencies could demonstrate that they were following all the guidance in FPC 65. There is a wide variation in the number of agencies that addressed various elements identified in the guidance. A contributing cause for the deficiencies in agency COOP plans is the level of FEMA oversight. In 1999, FEMA conducted an assessment of agency compliance with FPC 65, but it has not conducted oversight that is sufficiently regular and extensive to ensure that agencies correct the deficiencies identified. Because the resulting COOP plans do not include all the elements of a viable plan as defined by FPC 65, agency efforts to provide services during an emergency could be impaired.