DEPARTMENT OF HOMELAND SECURITY 

Office of Inspector General 

Letter Report: 

FEMA’s Progress in Addressing 

Information Technology Management 

Weaknesses 

OIG-07-17 December 2006
Office of Inspector General 

U.S. Department of Homeland Security 

Washington, DC 20528 

December 8, 2006 

MEMORANDUM FOR: R. David Paulison 

Director 

Federal Emergency Management Agency 

FROM: Richard L. Skinner 

Inspector General 

SUBJECT: FEMA’s Progress in Addressing Information Technology 

Management Weaknesses 

This letter provides the results of our follow-up audit of the Federal Emergency Management 

Agency’s (FEMA) efforts to address the response and recovery technology weaknesses identified in 

our September 2005 audit report, Emergency Preparedness and Response Could Better Integrate 

Information Technology with Incident Response and Recovery (OIG-05-36). In the report, we 

reviewed the Department of Homeland Security’s (DHS) approach to responding to and recovering 

from terrorist attacks, major disasters, and other domestic emergencies; assessed the effectiveness of 

guidance and processes to support information technology (IT) users during incident management; 

and, identified and evaluated existing and proposed systems and other technologies to help carry out 

FEMA’s mission. For this follow-up audit, we evaluated the progress that FEMA has made to 

address our prior report recommendations within the context of its plans and activities to improve 

the National Emergency Management Information System (NEMIS). We examined FEMA’s IT 

improvement efforts in both the short-term as the agency prepare for the 2006 hurricane season, as 

well as in the long-term as it works to align with the department’s overarching strategic direction. 

To conduct our follow-up audit, we evaluated compliance updates that FEMA provided us in 

December 2005 and April 2006, outlining milestones, action plans, and scheduled or actual dates for 

completing activities that address our report recommendations. We also obtained details from 

FEMA on two of its key IT improvement efforts: eNEMIS, a short-term upgrade effort intended to 

modernize current NEMIS components; and, Next Generation NEMIS, a large-scale restructuring 

effort involving system-wide transformation. We subsequently interviewed FEMA personnel and 

gathered and reviewed additional documentation, as appropriate, to assess the progress of FEMA’s 

initiatives. We conducted this audit according to generally accepted government auditing standards 

from June to August 2006, in the Washington, D.C. metropolitan area. 

cc: Jeanne Etzel, FEMA Acting Chief Information Officer 
SUMMARY RESULTS OF AUDIT 

FEMA has made progress in several areas, particularly short-term adjustments to prepare for the 

2006 hurricane season. These improvements primarily included increasing NEMIS capacity and 

online system access and strengthening verification of registration data. In addition, FEMA and its 

program offices specifically addressed our recommendations by documenting training resources, 

developing a plan to implement its enterprise architecture (EA), gathering requirements for new 

business tools, and improving configuration management. 

However, despite these positive steps, FEMA has not documented or communicated a strategic 

direction to guide long-term IT investment and system development efforts. FEMA also has not 

performed crosscutting requirements gathering to determine business needs, which would allow 

Information Technology Services Division (ITSD) personnel to analyze alternatives to continued 

development of the complex, custom NEMIS system. We note below several resource challenges 

for FEMA to accomplish these tasks, including personnel needs, time limitations, and funding 

constraints. For example, high-level officials acknowledged the need for personnel who can 

effectively and efficiently manage system development efforts, especially as key personnel are 

allocated to assist in disaster and emergency response activities. Further, FEMA officials told us 

that funding constraints also have prevented the creation of sufficient training and testing 

environments. Therefore, constrained by limited resources, FEMA has focused its efforts on 

preparing for the 2006 hurricane season and has made little progress in addressing long-term needs, 

such as updating strategic plans, defining cross-cutting requirements, and evaluating systems 

alternatives. 

RECOMMENDATION #1: STRATEGIC PLANS 

Office of Management and Budget (OMB) Circular A-11 recommends that component agencies 

create their own strategic plans linked to overarching departmentwide plans.1

 In September 2005, 

we reported that FEMA’s strategic and IT plans did not align completely with DHS’ strategic plan. 

Because FEMA had not updated its plans, there was little assurance that the agency could monitor 

and achieve the emergency management goals established by the department. We recommended 

that: 

The Under Secretary for Emergency Preparedness and Response (EP&R) update the FEMA 

strategic plan to support achievement of DHS goals and ensure that all FEMA systems provide 

the performance data necessary to measure progress toward achieving response and recovery 

goals. Subsequently, direct the EP&R CIO to update the IT strategic plan in line with the 

updated FEMA strategic plan.2 

In their December 2005 response to our recommendation, the Acting Director and the Chief 

Information Officer (CIO) of FEMA said that they were working in close coordination with the 

Office of Plans and Programs, and that the FEMA strategic plan would be updated during FY 2006, 

1

 Circular A-11, Part 6, Preparing and Submitting a Strategic Plan, Executive Office of the President, Office of 

Management and Budget, June 2005. 2

 On October 1, 2005, the Emergency Preparedness and Response (EP&R) Directorate was dismantled, with 

preparedness functions moved to a new Preparedness Directorate. FEMA, originally part of EP&R, became a separate 

DHS entity that reports directly to the Secretary and retained responsibility for consequence management after 

catastrophes, including response and recovery activities. 

2
with the IT strategic plan following thereafter. However, a subsequent response, dated April 2006, 

stated that due to longer-term retooling of FEMA and evaluations of FEMA by the Congress, the 

Government Accountability Office, the DHS Inspector General, and the White House Homeland 

Security Council, FEMA could not specify when its strategic plan would be updated, although it 

anticipated that the plan would be updated this fiscal year. 

FEMA’s decision to focus on short-term improvements for the 2006 hurricane season has increased 

system capabilities; however, it also has created risks for long-term strategic coordination and IT 

development. Because necessary updates to FEMA’s strategic plan and the IT strategic plan have 

been put aside, the misalignment of DHS and FEMA strategic plans continues. This misalignment 

complicates efforts to link IT initiatives to overarching mission direction. It also increases the 

potential that IT initiatives might not support the achievement of DHS response and recovery goals 

in both the short- and long-term. 

Short-term 

In the short-term, FEMA has successfully planned for and implemented solutions that address many 

of the IT shortfalls identified during the 2004 and 2005 hurricane seasons. For example, FEMA 

improved the capacity, scalability, and survivability of NEMIS to support disaster management. To 

do so, FEMA created an additional site for servers that could share the load of victim registrations 

and applicant processing across several sites. As a result, FEMA increased its disaster victim 

registration capacity so that NEMIS now can handle up to 200,000 registrations within a 24-hour 

period, which is approximately double the number handled during the hurricane Katrina recovery 

effort. Such increased capacity should decrease disaster victims’ wait time to register with FEMA; 

and ultimately, victims should receive assistance more efficiently and effectively. In addition, 

FEMA worked to reduce the potential for fraudulent disaster claims by adding automated applicant 

verification and validation checks during online and call center disaster registrations, allowing 

program area discretion in using this capability. Although these actions should improve FEMA’s 

ability to respond to disasters, the concentration on short-term solutions has been to the detriment of 

long-term planning. 

Long-term 

FEMA has not established long-term direction as an agency. In the absence of up-to-date FEMA 

and IT strategic plans, system development efforts may not meet the long-term mission needs of the 

department and the agency. Previous FEMA plans to upgrade NEMIS included a long-term 

integrated approach to system development. However, recent NEMIS updates have continued 

without sufficient definition and understanding of the future direction of the NEMIS architecture. 

For example, the Emergency Management Mission Integrated Environment (EMMIE), an effort to 

provide a single grants processing capability within the NEMIS platform, is being developed without 

a clear understanding and definition of Next Generation NEMIS. The EMMIE project scope 

document acknowledges the risks of developing system components without first defining the longterm vision of NEMIS, stating that: 

• Insufficient planning may result in unnecessary system rework and delays; 

• The existing NEMIS architecture may be significantly different from the expected Next 

Generation NEMIS future architecture, hindering the ability to design, as required, a 

system that integrates with both; and, 

• The EMMIE project may be seen as duplicative of DHS or other federal efforts. 

3
Without meaningful strategic plans that provide direction and focus for aligning IT with response 

and recovery goals, FEMA cannot ensure that its IT funding is effectively spent and that projected 

systems will meet future needs. As such, our recommendation will remain open until the FEMA and 

IT strategic plans have been updated. 

RECOMMENDATION #2: TRAINING, GUIDANCE, AND COMMUNICATION 

OMB Circular A-130 states that users of federal information resources must have the skills, 

knowledge, and training to manage information resources.3

 In September 2005, we reported that 

additional guidance and training were necessary to ensure that FEMA system users have the 

knowledge and information necessary to perform their jobs efficiently and effectively. We 

recommended that: 

The Under Secretary for EP&R direct the EP&R CIO to ensure that personnel, through the 

EP&R training division, receive adequate systems training, guidance, and communication 

needed to support disaster response and recovery activities effectively. 

FEMA has taken a number of positive steps to respond to this recommendation. First, FEMA met 

with our office to clarify the scope of the recommendation. Following that meeting, FEMA 

established plans to address user training, guidance, and communication. Specifically, FEMA 

surveyed users’ training needs and partnered with the Emergency Management Institute to develop a 

training plan. Second, FEMA began offering online training and linked system training (“how” to 

perform a task) with job training (“when” or “why” to perform a task). Third, FEMA provided upto-date system user guidance. FEMA also has updated and standardized operating procedures for 

system users across all National Processing Service Centers. 

Although FEMA has improved training and guidance, additional resources are necessary to develop 

a robust training environment. For example, FEMA officials said that they do not have a training 

environment where new users can practice or test their skills and that this has limited their ability to 

train personnel effectively. Although FEMA has a test and development lab that it uses for training, 

it has limited capacity and is unable to accommodate the large numbers of new employees that 

FEMA hires and trains during disaster responses. The lack of a sufficient training environment also 

makes it difficult to evaluate more experienced users as they take on increasingly complex jobs 

within the system. 

In addition, better communication between FEMA system users and program offices regarding 

system changes and strategic system direction is needed. In particular, experienced system users do 

not receive adequate communication or documentation of system updates or business process 

changes. Users also need additional communication on the scope of the eNEMIS project and plans 

for future IT developments that may benefit response activities. For example, when asked to explain 

NEMIS development efforts, several program area officials could not differentiate between 

eNEMIS, Next Generation NEMIS, or EMMIE. 

Moreover, even though FEMA’s CIO created the Project Management Office to develop personnel 

and capabilities in project, program, and portfolio management, the appointed IT liaisons within this 

3

 Revision of Office of Management and Budget Circular A-130, Transmittal 4, Management of Federal Information 

Resources, November 2000. 

4
office are not always effective. For example, officials said that IT liaisons are overburdened or 

unavailable for consultation on program needs and development. Also, high-level FEMA officials 

said that personnel with customer relationship management skills are needed to improve 

communication between ITSD and the FEMA program offices regarding system updates and 

training. Based on these findings, our recommendation will remain open until FEMA ensures that 

users receive adequate communication on system updates and overall IT direction. A sufficient 

training environment available for system users would be beneficial to support this effort. 

RECOMMENDATION #3: ENTERPRISE ARCHITECTURE 

The Clinger-Cohen Act of 1996 requires the CIO to develop, maintain, and facilitate the 

implementation of a sound, enterprise-wide IT architecture.4

 In September 2005, we reported that 

FEMA had not yet defined its ‘to be’ enterprise architecture (EA). We recommended that: 

The Under Secretary for EP&R direct the EP&R CIO to complete the FEMA enterprise 

architecture, linked to the departmentwide architecture and ongoing initiatives that may 

impact EP&R operations. 

In response, FEMA developed a comprehensive five-year roadmap for achieving the highest 

possible EA level, including a long-term plan for completion of the “to be” architecture and a 

transition strategy. Once documented, the EA is expected to support systems integration and 

effective information exchange, define a strategy for IT, and allow FEMA to map its IT initiatives 

and link them to departmentwide IT goals. 

As a result, we are leaving this recommendation open until FEMA completes execution of its EA 

plan and the “to be” EA is fully documented and approved by the DHS CIO. 

RECOMMENDATION #4: REQUIREMENTS GATHERING AND ALTERNATIVES

ANALYSIS

OMB Circular A-11 directs agencies to reduce project risk by involving stakeholders in the design of 

IT assets, as users can play an important role in helping to define systems requirements to meet 

mission needs.5

 In addition, OMB Circular A-130 encourages agencies to consider various options 

for providing automated systems to meet their mission needs.6

 However, in September 2005, we 

reported that FEMA’s approach to defining requirements to support development of its principal 

disaster management system, NEMIS, was ineffective. We said that without fully defining and 

documenting system requirements, it was difficult for FEMA to evaluate viable alternatives to 

NEMIS. We recommended that: 

4 Clinger-Cohen Act (formerly the Information Technology Reform Act of 1996), Public Law 104-106, Division E. 5

 Circular A-11, Part 7, Budgeting, Acquisition, and Management of Capital Assets, Executive Office of the President, 

Office of Management and Budget, June 2005. 6

 Revision of Office of Management and Budget Circular A-130, Transmittal 4, Management of Federal Information 

Resources, November 2000. 

5
The Under Secretary for EP&R ensure crosscutting participation from headquarters, regions, 

and states in processes to develop and maintain a complete, documented set of FEMA business 

and system requirements. Direct the EP&R CIO to analyze alternatives and determine the 

most appropriate approach to providing the technology needed to support these business and 

system requirements. 

FEMA has taken a number of positive steps to address this recommendation. Specifically, FEMA 

identified three initiatives to obtain, manage, and implement requirements. First, as noted above, 

FEMA created the Project Management Office to facilitate requirements gathering and 

communication. Second, FEMA prepared to implement system development life cycle governance 

as part of its capital planning and investment control process. Third, FEMA created an Agile System 

Development branch to gather and respond to urgent requirements identified during disasters. 

Despite these improvements, program offices did not gather crosscutting business and system 

requirements. For example, the Public Assistance branch supported EMMIE development, the new 

grants management application, but the Mitigation Division chose not to participate because ITSD’s 

plan was insufficient. Mitigation officials said that ITSD did not have an adequate number of 

personnel with appropriate skill sets to meet emerging needs in project and customer management. 

One senior ITSD official said that the systems engineering and development branch would need to 

double its staff to successfully meet demand. 

As a result, FEMA has not sufficiently documented requirements for NEMIS, and therefore, is 

unable to perform an adequate alternatives analysis for this system. Specifically, the business cases 

for Next Generation NEMIS and eNEMIS limited consideration to custom solutions, although 

FEMA program officials said that components of NEMIS likely could be replaced with off-the-shelf 

alternatives. Without gathering requirements and analyzing alternatives, FEMA ITSD may not take 

advantage of the most appropriate technologies available. 

Our recommendation will remain open until FEMA ensures crosscutting participation in developing 

and documenting business and system requirements, and the FEMA CIO analyzes alternatives to 

establish the most appropriate approach to providing technology for those requirements. 

RECOMMENDATION #5: CONFIGURATION MANAGEMENT AND TESTING 

ENVIRONMENT 

In September 2005, we reported that FEMA did not have an adequate test environment and did not 

always test systems sufficiently prior to release to ensure that new IT functionality will work 

properly and contain needed safeguards. Without an adequate testing environment, FEMA is 

vulnerable to the risks associated with improper testing, such as increased failure rates and 

development costs.7 We recommended that: 

The Under Secretary for EP&R direct the EP&R CIO to develop and maintain a testing 

environment that duplicates the real systems environment and ensures that all systems 

components are properly and thoroughly tested prior to their release. Additionally, direct the 

EP&R CIO to ensure that proper configuration management activities are followed and 

documented. 

7 Planning Report 02-3, The Economic Impacts of Inadequate Infrastructure for Software Testing, National Institute of 

Standards and Technology, May 2002. 

6
In response, FEMA officials said that they were compiling a comprehensive update for configuration 

management policy and provided copies of their updated procedures. FEMA also outlined a twophased approach for implementing an adequate testing environment. During the first phase, FEMA 

planned to upgrade the equipment in the testing and development lab (TDL) in time to test 

applications for the 2006 hurricane season. For the second phase, FEMA plans to establish a new 

test environment completely independent of the existing TDL by the 2008 hurricane season. 

Despite these plans, FEMA has not yet established an adequate testing environment. FEMA 

officials stated that insufficient funding limited their ability to provide a proper testing environment. 

A senior FEMA IT official requested the establishment of a new test environment as part of the Next 

Generation NEMIS project; however, project funding was denied. Further, the complex NEMIS 

system, with over 1,000 business rules, makes it difficult and costly to replicate in a mirror testing 

environment. As such, FEMA has not implemented phase 1 improvements for the 2006 hurricane 

season and does not have a schedule to implement phase 2 improvements. This recommendation 

will remain open until FEMA takes the steps needed to ensure availability of an adequate testing 

environment. 

7
MANAGEMENT COMMENTS AND OIG EVALUATION 

We obtained written comments on a draft of this report from FEMA’s Acting Chief Information 

Officer, through the FEMA Director. We have included a copy of the comments in their entirety in 

Appendix A of this report. 

In the comments, the Acting CIO concurred with our follow-up assessment of progress made and 

provided updates on the status of FEMA’s efforts to implement each of the five recommendations 

included in our prior September 2005 report. The Acting CIO understood that each of the 

recommendations will remain open until actions within FEMA’s Plans of Action and Milestones are 

completed. Since the initial September 2005 audit report, FEMA’s Office of the CIO has 

consistently provided the OIG with 90-day status updates concerning its plans and actions to address 

our recommendations. In addition, the Acting CIO holds bi-weekly meetings to ensure that progress 

is being made on implementing the recommendations. 

In response to recommendation 1, the Acting CIO acknowledged the importance of linking FEMA’s 

Strategic Plan to the long-term retooling of FEMA. The Acting CIO recounted that to prepare for 

the 2006 hurricane season, however, the DHS Secretary directed that short-term retooling efforts 

take precedence over long-term planning efforts. Because of the concentration on short-term 

retooling efforts, FEMA’s Strategic Planning Office was unable to update FEMA’s Strategic Plan in 

FY 2006, but intends to do so. Once this plan is revised, the Acting CIO will update the Information 

Technology Strategic Plan within nine months. We look forward to receiving progress reports on 

the Strategic Planning Office’s efforts to update FEMA’s Strategic Plan, as well as the Office of the 

CIO’s subsequent efforts to revise its IT Strategic Plan. 

In response to recommendation 2, the Acting CIO stated that FEMA has made significant progress 

by continuing to improve NEMIS training and guidance through field training, train-the-trainer 

activities, and continued development of user support materials. However, the Acting CIO conceded 

that systems training still occurs in a test and development environment, making it challenging for 

FEMA to ensure that personnel receive suitable IT instruction. Additional physical space also is 

needed within the data center to establish distinct training environments. As NEMIS is updated, 

there are plans to create a dedicated training environment. In addition, an internal working group is 

being formed to support the further enhancement of FEMA’s training and guidance activities. 

Lastly, the Acting CIO believes that ongoing efforts to refine its Program Management Office, the 

Enterprise Architecture, and IT customer liaison functions will improve customer relationship 

management and communications with system stakeholders. We are encouraged by the recent 

activities completed and believe that the steps outlined mark progress toward ensuring that FEMA 

personnel receive adequate systems training, guidance, and communication. 

To address recommendation 3, FEMA has restarted its efforts to formulate the “to be” enterprise 

architecture and has filled previously vacant employee positions to support this effort. These 

additional resources should place FEMA in a better position to refine its enterprise architecture. We 

look forward to receiving updates concerning the status of FEMA’s efforts to formulate its “to be” 

enterprise architecture. 

In response to recommendation 4, the Acting CIO discussed plans for ensuring crosscutting 

representation and participation by the various stakeholder communities to maintain a complete, 

documented set of FEMA business and system requirements. Specifically, the Acting CIO stated 

that FEMA performed an extensive analysis of the requirements and design and development 

8
alternatives for the EMMIE system, the new application to replace NEMIS grants functionality. As 

stated in our report, not all program areas participated in the requirements definition for EMMIE, 

which therefore did not ensure complete, cross-functional requirements. Additionally, the business 

case for eNEMIS limited consideration to custom solutions, although FEMA program officials said 

that components of NEMIS likely could be replaced with off-the-shelf alternatives. Specifically, the 

eNEMIS business case lists the following three alternatives: (1) using the existing, custom-based 

system, (2) upgrading the existing two-tiered client-server technology to an internet, custom-based 

application, or (3) building a new custom system to meet all of the requirements. However, the 

business case does not consider potential off-the-shelf solutions to meet customer needs and also 

states that “No known disaster assistance system provides the level of access, redundancy, 

functionality and mobility as NEMIS/eNEMIS currently provides.” 

We believe that although off-the-shelf systems may not provide all of the functionality of a custombased system, there is no indication that an analysis was performed to determine if an off-the-shelf 

solution could meet FEMA’s disaster assistance needs. Without such an analysis, FEMA ITSD may 

not take advantage of the most appropriate technologies available. 

Finally, to address recommendation 5, the Acting CIO said that in addition to needing an adequate 

testing environment, FEMA also requires the establishment of sufficient production, development, 

and training environments. The Acting CIO is working to resolve current space constraints within 

the data center to add the additional hardware needed to expand the existing technical environments. 

Further, the Acting CIO is refining FEMA’s configuration and software release management 

processes and ensuring the availability of sufficient personnel resources to support these processes. 

We are encouraged by the Acting CIO’s efforts to expand the existing technical environments and 

look forward to hearing about progress in this area. 

9
Appendix A 

MANAGEMENT COMMENTS

10
11
12
13
Additional Information and Copies 

To obtain additional copies of this report, call the Office of Inspector General 

(OIG) at (202) 254-4100, fax your request to (202) 254-4285, or visit the OIG 

web site at www.dhs.gov/oig. 

OIG Hotline 

To report alleged fraud, waste, abuse or mismanagement, or any other kind 

of criminal or noncriminal misconduct relative to department programs or 

operations, call the OIG Hotline at 1-800-323-8603; write to DHS Office of 

Inspector General/MAIL STOP 2600, Attention: Office of Investigations– 

Hotline, 245 Murray Drive, SW, Building 410, Washington, DC 20528; fax 

the complaint to (202) 254-4292; or email DHSOIGHOTLINE@dhs.gov. The 

OIG seeks to protect the identity of each writer and caller.